name: fiberlab

services:
  netd:
    image: ${FIBERLAB_IMAGE:?Image is required}
    user: "0:0"
    privileged: true
    ports:
      - "127.0.0.1:18787:18788"
    restart: unless-stopped
    init: true
    command: [netd, --data-dir, /data, --uid, "1000", --runtime-dir, /var/lib/fiberlab/1000]
    group_add: ["${KVM_GID:?KVM group is required}"]
    volumes:
      - ${DEPLOY_ROOT:?Deployment directory is required}/shared/data:/data
      - /var/lib/fiberlab:/var/lib/fiberlab
    stop_grace_period: 60s
    healthcheck:
      test: [CMD, curl, --fail, --silent, --unix-socket, /data/netd.sock, http://localhost/health]
      interval: 5s
      timeout: 3s
      retries: 12

  app:
    image: ${FIBERLAB_IMAGE}
    user: "1000:1000"
    network_mode: service:netd
    restart: unless-stopped
    init: true
    security_opt: [no-new-privileges:true]
    volumes:
      - ${DEPLOY_ROOT}/shared/data:/data
    depends_on:
      netd:
        condition: service_healthy
    healthcheck:
      test: [CMD, curl, --fail, --silent, http://127.0.0.1:18787/api/v1/health]
      interval: 5s
      timeout: 3s
      retries: 12
    stop_grace_period: 15s

  proxy:
    image: ${FIBERLAB_IMAGE}
    user: "1000:1000"
    network_mode: service:netd
    restart: unless-stopped
    init: true
    security_opt: [no-new-privileges:true]
    entrypoint: [/usr/bin/socat]
    command: ["TCP-LISTEN:18788,reuseaddr,fork", "TCP:127.0.0.1:18787"]
    depends_on:
      app:
        condition: service_healthy
    healthcheck:
      test: [CMD, curl, --fail, --silent, http://127.0.0.1:18788/api/v1/health]
      interval: 5s
      timeout: 3s
      retries: 12

  web:
    image: nginx:stable-alpine
    network_mode: host
    restart: unless-stopped
    security_opt: [no-new-privileges:true]
    volumes:
      - ${DEPLOY_ROOT}/current/deploy/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ${DEPLOY_ROOT}/shared/htpasswd:/etc/nginx/fiberlab.htpasswd:ro
    depends_on:
      proxy:
        condition: service_healthy