services:
  overlord-server:
    image: ghcr.io/vxaboveground/overlord:latest
    build:
      context: .
      dockerfile: Dockerfile
      cache_from:
        - type=local,src=.docker-cache/buildx
      cache_to:
        - type=local,dest=.docker-cache/buildx,mode=max
    container_name: overlord-server
    # Host networking: the container shares the host's network stack directly.
    # Every port the server binds (5173, SOCKS5 proxies, etc.) is accessible
    # on the host with zero overhead — no per-port proxy process.
    network_mode: host
    environment:
      # Optional username for first admin user
      - OVERLORD_USER=admin
      # Leave these empty to auto-generate and persist to /app/data/save.json
      - OVERLORD_PASS=
      - JWT_SECRET=
      - OVERLORD_AGENT_TOKEN=
      # Server settings
      - PORT=5173
      - HOST=0.0.0.0
      # TLS paths (self-signed is auto-generated if not present)
      - OVERLORD_TLS_CERT=/app/certs/server.crt
      - OVERLORD_TLS_KEY=/app/certs/server.key
      - OVERLORD_TLS_CA=
      # Set true only behind a trusted reverse proxy that terminates TLS (for example Render).
      # Default false keeps current behavior: Overlord terminates TLS in-process.
      - OVERLORD_TLS_OFFLOAD=false
      # Trust X-Forwarded-For / X-Real-IP / CF-Connecting-IP from an upstream proxy when
      # resolving the agent's source IP shown in the dashboard, audit log, and IP bans.
      # Set true only when a trusted reverse proxy (nginx, Caddy, Cloudflare, etc.) sits
      # in front of Overlord — otherwise agents can spoof their IP. Auto-enabled when
      # OVERLORD_TLS_OFFLOAD=true.
      - OVERLORD_TRUST_PROXY=false
      # Cookie security mode: auto (default), true, or false.
      # auto: Secure cookie on HTTPS requests / X-Forwarded-Proto=https.
      - OVERLORD_AUTH_COOKIE_SECURE=auto
      # Optional certbot integration (used only when NODE_ENV=production)
      - OVERLORD_TLS_CERTBOT_ENABLED=false
      - OVERLORD_TLS_CERTBOT_LIVE_PATH=/etc/letsencrypt/live
      - OVERLORD_TLS_CERTBOT_DOMAIN=
      - OVERLORD_TLS_CERTBOT_CERT_FILE=fullchain.pem
      - OVERLORD_TLS_CERTBOT_KEY_FILE=privkey.pem
      - OVERLORD_TLS_CERTBOT_CA_FILE=chain.pem
      - OVERLORD_CLIENT_BUILD_CACHE_DIR=/app/client-build-cache
      - OVERLORD_FILE_UPLOAD_INTENT_TTL_MS=1800000
      - OVERLORD_FILE_UPLOAD_PULL_TTL_MS=1800000
      - OVERLORD_TURN_HOST=${OVERLORD_TURN_HOST:-127.0.0.1}
      - OVERLORD_TURN_PORT=${OVERLORD_TURN_PORT:-3478}
      - OVERLORD_TURN_REALM=${OVERLORD_TURN_REALM:-overlord}
      - OVERLORD_TURN_SECRET_FILE=/run/overlord-turn/secret
      - OVERLORD_TURN_CREDENTIAL_TTL_SECONDS=${OVERLORD_TURN_CREDENTIAL_TTL_SECONDS:-3600}
    volumes:
      - overlord-data:/app/data
      - overlord-certs:/app/certs
      - overlord-client-build-cache:/app/client-build-cache
      - overlord-plugins:/app/plugins
      - overlord-turn-secret:/run/overlord-turn:ro
      # Uncomment to mount host certbot certs read-only
      # - /etc/letsencrypt:/etc/letsencrypt:ro
      # Uncomment to use a static config file instead of env vars
      # - ./Overlord-Server/config.json:/app/config.json:ro
    restart: unless-stopped
    healthcheck:
      # Use http:// when OVERLORD_TLS_OFFLOAD=true.
      test: ["CMD-SHELL", "wget -qO- --no-check-certificate ${OVERLORD_HEALTHCHECK_URL:-https://localhost:5173/health} >/dev/null 2>&1 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    depends_on:
      turn-secret-init:
        condition: service_completed_successfully

  turn-secret-init:
    image: alpine:3.22
    command: ["/bin/sh", "-ec", "umask 077; if [ ! -s /run/overlord-turn/secret ]; then head -c 32 /dev/urandom | base64 > /run/overlord-turn/secret; fi; IFS= read -r turn_secret < /run/overlord-turn/secret; printf 'webrtcICEServers2:\n  - url: \"stun:%s:%s\"\n  - url: \"turn:%s:%s?transport=udp\"\n    username: AUTH_SECRET\n    password: \"%s\"\n    clientOnly: true\n  - url: \"turn:%s:%s?transport=tcp\"\n    username: AUTH_SECRET\n    password: \"%s\"\n    clientOnly: true\n' \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$$turn_secret\" \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$$turn_secret\" > /run/overlord-turn/mediamtx.yml; chmod 0444 /run/overlord-turn/secret /run/overlord-turn/mediamtx.yml"]
    environment:
      OVERLORD_TURN_HOST: ${OVERLORD_TURN_HOST:-127.0.0.1}
      OVERLORD_TURN_PORT: ${OVERLORD_TURN_PORT:-3478}
    volumes:
      - overlord-turn-secret:/run/overlord-turn
    restart: "no"

  coturn:
    image: coturn/coturn:4.14.0-r0-alpine
    container_name: overlord-coturn
    network_mode: host
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        secret="$$(cat /run/overlord-turn/secret)"
        external=""
        if [ -n "$${OVERLORD_TURN_EXTERNAL_IP:-}" ]; then external="--external-ip=$${OVERLORD_TURN_EXTERNAL_IP}"; fi
        exec turnserver --fingerprint --use-auth-secret --static-auth-secret="$$secret" --realm="$${OVERLORD_TURN_REALM:-overlord}" --listening-port=3478 --min-port=49160 --max-port=49200 --no-tls --no-dtls --no-multicast-peers --log-file=stdout $$external
    environment:
      OVERLORD_TURN_REALM: ${OVERLORD_TURN_REALM:-overlord}
      OVERLORD_TURN_EXTERNAL_IP: ${OVERLORD_TURN_EXTERNAL_IP:-}
    volumes:
      - overlord-turn-secret:/run/overlord-turn:ro
    depends_on:
      turn-secret-init:
        condition: service_completed_successfully
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true

volumes:
  overlord-data:
  overlord-certs:
  overlord-client-build-cache:
  overlord-plugins:
  overlord-turn-secret: