services:
  p2pstream:
    image: "${P2PSTREAM_IMAGE:-ghcr.io/kirari04/p2pstream:latest}"
    container_name: p2pstream
    restart: unless-stopped
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    tmpfs:
      - /tmp:rw,nosuid,nodev,mode=1777
    environment:
      CONFIG_DIR: /data
      MANAGEMENT_PORT: "8081"
      # Default accepts Docker forwarding; preserve explicit operator overrides.
      MANAGEMENT_BIND_ADDRESS: "${MANAGEMENT_BIND_ADDRESS:-0.0.0.0}"
      MANAGEMENT_UI_DISABLED: "${MANAGEMENT_UI_DISABLED:-false}"
      MANAGEMENT_PUBLIC_URL: "${MANAGEMENT_PUBLIC_URL:-https://localhost:8081}"
      MANAGEMENT_SETUP_TOKEN: "${MANAGEMENT_SETUP_TOKEN:-}"
      MANAGEMENT_TLS_EXTRA_HOSTS: "${MANAGEMENT_TLS_EXTRA_HOSTS:-}"
      MANAGEMENT_TRUSTED_PROXY_CIDRS: "${MANAGEMENT_TRUSTED_PROXY_CIDRS:-}"
      MANAGEMENT_CLIENT_IP_HEADER: "${MANAGEMENT_CLIENT_IP_HEADER:-X-Forwarded-For}"
      MANAGEMENT_CLIENT_IP_MODE: "${MANAGEMENT_CLIENT_IP_MODE:-trusted_chain}"
      PUBLIC_MAX_HEADER_BYTES: "${PUBLIC_MAX_HEADER_BYTES:-65536}"
      PUBLIC_MAX_REQUEST_BODY_BYTES: "${PUBLIC_MAX_REQUEST_BODY_BYTES:-1073741824}"
      PUBLIC_REQUEST_BODY_IDLE_TIMEOUT_MILLIS: "${PUBLIC_REQUEST_BODY_IDLE_TIMEOUT_MILLIS:-30000}"
      PUBLIC_MAX_CONCURRENT_REQUESTS: "${PUBLIC_MAX_CONCURRENT_REQUESTS:-2048}"
      PUBLIC_MAX_CONCURRENT_REQUESTS_PER_TARGET: "${PUBLIC_MAX_CONCURRENT_REQUESTS_PER_TARGET:-0}"
      PUBLIC_MAX_CONNECTIONS_PER_TARGET: "${PUBLIC_MAX_CONNECTIONS_PER_TARGET:-256}"
      SERVER_TUNNEL_MAX_CONCURRENT_STREAMS: "${SERVER_TUNNEL_MAX_CONCURRENT_STREAMS:-0}"
    ports:
      - "${P2PSTREAM_HTTP_PORT:-80}:80"
      - "${P2PSTREAM_HTTPS_PORT:-443}:443"
      - "${P2PSTREAM_MANAGEMENT_PUBLISH_ADDRESS:-}:${P2PSTREAM_MANAGEMENT_PORT:-8081}:8081"
    volumes:
      - p2pstream-data:/data

volumes:
  p2pstream-data:
    name: p2pstream-data