services:
  gluetun:
    image: qmcgaw/gluetun:${IMG_GLUETUN_TAG}
    container_name: gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      # These are the ports for the webtop.
      # Using `0.0.0.0`, we bind this to all interfaces on the host machine.
      # This allows you to access the webtop from other devices on your local network by using the host machine's IP address.
      # However, this may be too insecure. If you only want to access the webtop from the host machine ONLY, remove the `0.0.0.0:` and just use `3000:3000` and `3001:3001` to bind to localhost only.
      - ${GLUETUN_BIND_ADDR}:${DESKTOP_HTTP_PORT}:3000
      - ${GLUETUN_BIND_ADDR}:${DESKTOP_HTTPS_PORT}:3001
    volumes:
      - ./gluetun:/gluetun
    env_file:
      - .env.gluetun
    # Disable IPv6 (see bottom).
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
    restart: unless-stopped
  desktop:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        IMG_DESKTOP_TAG: ${IMG_DESKTOP_TAG}
    container_name: desktop
    network_mode: "service:gluetun"
    # Only boot the desktop container after the VPN is up and healthy to ensure it has a secure connection before starting any applications.
    depends_on:
      gluetun:
        condition: service_healthy
    # These security options + capabilities fixed issues related to running Chromium and other applications.
    security_opt:
      - seccomp:unconfined
      - apparmor:unconfined
    cap_add:
      - SYS_ADMIN
    env_file:
      - .env.desktop
    volumes:
      - ./config:/config     # Persist user data and settings including home directory, application data (e.g. web browser sessions/cookies), and desktop configuration.
    shm_size: "1gb"          # Give it enough shared memory for applications like Chromium to run smoothly.
    restart: unless-stopped
    # Disable IPv6 to prevent potential leaks and connectivity issues, especially since the VPN may not support IPv6.
    # If you need IPv6, remove these!
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv6.conf.default.disable_ipv6=1
      - net.ipv6.conf.lo.disable_ipv6=1