services:
  gateway:
    build: .
    image: appliance-gateway:latest
    container_name: appliance-gateway
    hostname: appliance-gw
    cap_add:
      - NET_ADMIN
    sysctls:
      net.ipv4.ip_forward: 1
    environment:
      # Initial credentials — students should be made to change these.
      APPLIANCE_ADMIN_PASSWORD: "ChangeMe123!"   # web UI 'admin' (forced change on first login)
      APPLIANCE_SSH_PASSWORD: "ChangeMe123!"     # OS 'admin' account for SSH
      WAN_IF: eth0        # interface NAT masquerades out of
      SNIFF_IFACE: eth0   # interface the traffic logger listens on
      APPLIANCE_VERSION: "GatewayOS 3.2.1"   # version shown on the login/UIs
    ports:
      - "80:80"      # HTTP  -> redirects to HTTPS
      - "443:443"    # HTTPS management UI
      - "2222:22"    # SSH management
      - "3128:3128"  # HTTP/HTTPS proxy
    volumes:
      - appliance-data:/data
    restart: unless-stopped

  # For GATEWAY mode (clients pointing their default gateway at the appliance),
  # the container needs a real address on the client LAN. See README.md for the
  # macvlan / host-network variants.

volumes:
  appliance-data: