# Demo: tunnel an nginx HTTP service through Iroh with serve + access.
#
# Quick start:
#   docker compose up web serve          # serve prints its NodeId
#   # paste that NodeId into examples/access.toml
#   docker compose up access             # exposes the tunnel on :8080
#   curl http://localhost:8080           # nginx default page, via tunnel
#
# `access` is in the `demo` profile so it only starts on demand (it needs the
# serve NodeId pasted into examples/access.toml first).

services:
  # The local service being tunneled (a plain nginx serving its default page).
  web:
    image: nginx:alpine

  # Serve role: publish the `web` service into Iroh.
  serve:
    build: .
    command: ["serve", "run", "--config", "/etc/iroh-tunnel/serve.toml"]
    volumes:
      # Read-only: the example ships with a demo key, so serve never needs to
      # write back (and the tracked example file is never mutated).
      - ./examples/serve.toml:/etc/iroh-tunnel/serve.toml:ro
    depends_on:
      - web
    restart: unless-stopped

  # Access role: consume the remote `web` service to local port 8080.
  # Start separately after pasting serve's NodeId into examples/access.toml.
  access:
    build: .
    command: ["access", "run", "--config", "/etc/iroh-tunnel/access.toml"]
    volumes:
      - ./examples/access.toml:/etc/iroh-tunnel/access.toml:ro
    ports:
      # Bind to loopback only — this demo exposes the tunnel on the host, not
      # on external interfaces.
      - "127.0.0.1:8080:8080"
    profiles:
      - demo