version: '3.8'
services:
  vpn-server:
    build: .
    container_name: vpn-server
    ports:
      - "8080:8080"
      # - "1080:1080"  # Uncomment for SOCKS5
    environment:
      - VPN_USER=${VPN_USER:-}
      - VPN_PASS=${VPN_PASS:-}
      - VPN_ACL_MODE=${VPN_ACL_MODE:-off}
      - VPN_ACL=${VPN_ACL:-}
      # TLS example (mount certs):
      # - VPN_TLS_CERT=/certs/cert.pem
      # - VPN_TLS_KEY=/certs/key.pem
    volumes:
      # Optional: persist config (avoid for secrets)
      - ./config.json:/app/config.json:ro
      # For TLS certs:
      # - ./certs:/certs:ro
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/health"]
      interval: 30s
      timeout: 5s
      retries: 3
    # To enable TLS, set env and mount certs, then use https in clients