services:
  nginx-reverse-emby:
    image: ${NRE_IMAGE:-sakullla/nginx-reverse-emby:latest}
    container_name: nginx-reverse-emby
    restart: unless-stopped
    network_mode: host

    environment:
      # 面板 / Master 角色
      PANEL_ROLE: master
      PANEL_BACKEND_HOST: ${PANEL_BACKEND_HOST:-127.0.0.1}
      PANEL_BACKEND_PORT: "8080"

      # 面板登录 token；必须在启动前设置为随机长字符串
      API_TOKEN: ${API_TOKEN:?set API_TOKEN to a random 32+ character token}

      # Agent 注册 token；必须不同于 API_TOKEN
      MASTER_REGISTER_TOKEN: ${MASTER_REGISTER_TOKEN:?set MASTER_REGISTER_TOKEN to a random 32+ character token}

      # 可选的 secret-vault 32-byte master key。留空时从 API_TOKEN 确定性派生；
      # 已存储 secret 后更换 API_TOKEN 前，应先固定并保留显式 master key。
      PANEL_VAULT_MASTER_KEY: ${PANEL_VAULT_MASTER_KEY:-}
      PANEL_VAULT_KEY_ID: ${PANEL_VAULT_KEY_ID:-primary}
      # 更换 key 时临时提供旧 key（或旧 API token）及其原 key ID；迁移成功后删除。
      PANEL_VAULT_PREVIOUS_MASTER_KEY: ${PANEL_VAULT_PREVIOUS_MASTER_KEY:-}
      PANEL_VAULT_PREVIOUS_API_TOKEN: ${PANEL_VAULT_PREVIOUS_API_TOKEN:-}
      PANEL_VAULT_PREVIOUS_KEY_ID: ${PANEL_VAULT_PREVIOUS_KEY_ID:-}

      # 公网/HTTPS 反代部署时设置，例如 https://panel.example.com
      NRE_PUBLIC_URL: ${NRE_PUBLIC_URL:-}
      # 无域名 HTTP 临时部署时可设置随机面板入口，例如 /panel-a1b2c3d4
      NRE_PANEL_PUBLIC_PATH: ${NRE_PANEL_PUBLIC_PATH:-}
      # 仅当上游反代会清洗并重写 X-Forwarded-* 头时开启
      NRE_TRUST_FORWARDED_HEADERS: "${NRE_TRUST_FORWARDED_HEADERS:-false}"

      # Master 内嵌 local agent（默认启用）
      NRE_ENABLE_LOCAL_AGENT: "1"
      NRE_LOCAL_AGENT_ID: local
      NRE_LOCAL_AGENT_NAME: local
      # 本地 Agent 到 HTTP 后端的传输调优；NRE_HTTP2_ENABLED=false
      # 时仅禁用上游连接的 HTTP/2，不影响客户端入口协议。
      NRE_HTTP2_ENABLED: ${NRE_HTTP2_ENABLED:-true}
      NRE_HTTP_DIAL_TIMEOUT: ${NRE_HTTP_DIAL_TIMEOUT:-30s}
      NRE_HTTP_TLS_HANDSHAKE_TIMEOUT: ${NRE_HTTP_TLS_HANDSHAKE_TIMEOUT:-10s}
      NRE_HTTP_RESPONSE_HEADER_TIMEOUT: ${NRE_HTTP_RESPONSE_HEADER_TIMEOUT:-30s}
      NRE_HTTP_IDLE_CONN_TIMEOUT: ${NRE_HTTP_IDLE_CONN_TIMEOUT:-90s}
      NRE_HTTP_KEEP_ALIVE: ${NRE_HTTP_KEEP_ALIVE:-30s}
      NRE_HTTP_MAX_CONNS_PER_HOST: ${NRE_HTTP_MAX_CONNS_PER_HOST:-64}
      NRE_HTTP_STREAM_RESUME_ENABLED: ${NRE_HTTP_STREAM_RESUME_ENABLED:-true}
      NRE_HTTP_STREAM_RESUME_MAX_ATTEMPTS: ${NRE_HTTP_STREAM_RESUME_MAX_ATTEMPTS:-2}
      NRE_HTTP_SAME_BACKEND_RETRY_ATTEMPTS: ${NRE_HTTP_SAME_BACKEND_RETRY_ATTEMPTS:-1}
      NRE_BACKEND_FAILURE_BACKOFF_BASE: ${NRE_BACKEND_FAILURE_BACKOFF_BASE:-1s}
      NRE_BACKEND_FAILURE_BACKOFF_LIMIT: ${NRE_BACKEND_FAILURE_BACKOFF_LIMIT:-15s}
      # DDNS 公网 IP 探测间隔；独立于心跳和 Cloudflare DNS 对账间隔
      NRE_DDNS_IP_PROBE_INTERVAL: ${NRE_DDNS_IP_PROBE_INTERVAL:-5m}
      # 控制面板统一时区；用于日/月汇总、周期边界、流量清理口径和面板时间展示
      TZ: ${NRE_TIMEZONE:-Asia/Shanghai}
      NRE_TIMEZONE: ${NRE_TIMEZONE:-Asia/Shanghai}
      # Revision timeout 在创建 revision 时固化；后续环境变更不改写运行中 generation
      NRE_REVISION_APPLY_TIMEOUT: ${NRE_REVISION_APPLY_TIMEOUT:-1m}
      NRE_REVISION_DRAIN_TIMEOUT: ${NRE_REVISION_DRAIN_TIMEOUT:-10m}
      # 可选：单行 JSON，按 agent ID 覆盖 apply_timeout / drain_timeout
      NRE_REVISION_AGENT_TIMEOUT_OVERRIDES: ${NRE_REVISION_AGENT_TIMEOUT_OVERRIDES:-}
      # 可选：单次市场刷新（含 Git 拉取）的容忍上限；默认 30m
      NRE_MARKETPLACE_REFRESH_TIMEOUT: ${NRE_MARKETPLACE_REFRESH_TIMEOUT:-}
      # 单张托管证书 ACME 签发/续签最长时间；超时记录失败并继续调度其他证书
      NRE_MANAGED_CERT_ACME_TIMEOUT: ${NRE_MANAGED_CERT_ACME_TIMEOUT:-60m}

      # 可选：内部 tunnel-PKI vault 的 master key；必须是容器内受限绝对路径。
      # 使用外部目录时，同时取消下方 volume 示例的注释并保持路径一致。
      # 父目录必须可写，protected restore 会原子轮换 master.key；不要挂载只读单文件。
      NRE_PKI_MASTER_KEY_FILE: ${NRE_PKI_MASTER_KEY_FILE:-}

      # DNS 验证（按需启用，如 Cloudflare）
      ACME_DNS_PROVIDER: ${ACME_DNS_PROVIDER:-}
      CF_TOKEN: ${CF_TOKEN:-}

      # 可选：出站 HTTP(S) 代理（如市场刷新拉取 Git 仓库）。
      # host 网络容器内可用 http://192.168.65.254:<端口> 访问宿主机回环代理。
      HTTP_PROXY: ${HTTP_PROXY:-}
      HTTPS_PROXY: ${HTTPS_PROXY:-}
      NO_PROXY: ${NO_PROXY:-localhost,127.0.0.1,::1}

    volumes:
      - ./data:/opt/nginx-reverse-emby/panel/data
      # 外部 PKI key 目录示例（宿主目录 0700、master.key 0600）：
      # - ./secrets/nre-pki:/run/nre-pki