version: "3.9"

services:
  mediamtx:
    image: bluenviron/mediamtx:1.9.2
    container_name: mediamtx
    restart: unless-stopped
    ports:
      - "1935:1935"   # RTMP ingest
      - "8888:8888"   # HLS/HTTP (optional extern, Dashboard proxyt ohnehin)
    volumes:
      - ./mediamtx.yml:/mediamtx.yml:ro
    command: ["/mediamtx", "/mediamtx.yml"]

  dashboard:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: go-stream-dashboard
    restart: unless-stopped
    environment:
      # Dashboard
      - LISTEN=:8080
      - BASIC_AUTH_USER=${BASIC_AUTH_USER:-}
      - BASIC_AUTH_PASS=${BASIC_AUTH_PASS:-}
      - STREAMS=${STREAMS:-}
      # MediaMTX Endpunkte (im Compose‑Netzwerk erreichbar)
      - MTX_API=http://mediamtx:9997
      - MTX_HLS=http://mediamtx:8888
      - MTX_API_USER=${MTX_API_USER:-admin}
      - MTX_API_PASS=${MTX_API_PASS:-starkes-passwort}
    ports:
      - "8080:8080"
    depends_on:
      - mediamtx
    healthcheck:
      test: ["CMD", "/app/dashboard", "-healthcheck"] # optionaler Schalter, siehe unten
      interval: 15s
      timeout: 3s
      retries: 5
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp