services:
  netbird:
    image: netbirdio/netbird:${NETBIRD_VERSION:-latest}
    container_name: netbird-public-proxy
    hostname: ${NETBIRD_PEER_NAME:-public-proxy}
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
      - SYS_RESOURCE
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      NB_SETUP_KEY: ${NETBIRD_SETUP_KEY:?NETBIRD_SETUP_KEY is required}
      NB_MANAGEMENT_URL: ${NETBIRD_MANAGEMENT_URL:?NETBIRD_MANAGEMENT_URL is required}
      NB_LOG_LEVEL: ${NETBIRD_LOG_LEVEL:-info}
    volumes:
      - netbird-client:/var/lib/netbird

  edgeguard:
    image: ${EDGEGUARD_IMAGE:?EDGEGUARD_IMAGE is required}:${EDGEGUARD_VERSION:-latest}
    container_name: sessionguard-edgeguard
    restart: unless-stopped
    network_mode: host
    depends_on:
      - netbird
    command:
      - -config
      - /etc/sessionguard-edgeguard/edgeguard.json
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:size=16m,noexec,nosuid,nodev
    volumes:
      - ./edgeguard.json:/etc/sessionguard-edgeguard/edgeguard.json:ro
      - ./blacklist.txt:/etc/sessionguard-edgeguard/blacklist.txt:ro
      - ./rate-exempt.txt:/etc/sessionguard-edgeguard/rate-exempt.txt:ro
      - edgeguard-state:/var/lib/sessionguard-edgeguard

  caddy:
    image: caddy:${CADDY_VERSION:-2.11.4}
    container_name: caddy-public
    restart: unless-stopped
    network_mode: host
    depends_on:
      - netbird
      - edgeguard
    environment:
      ACME_EMAIL: ${ACME_EMAIL:?ACME_EMAIL is required}
      GUAC_HOST: ${GUAC_HOST:-ts.hilden.info}
      SESSIONGUARD_HOST: ${SESSIONGUARD_HOST:-sessionguard.hilden.info}
      GUAC01_IP: ${GUAC01_IP:?GUAC01_IP is required}
      GUAC02_IP: ${GUAC02_IP:?GUAC02_IP is required}
      GUAC03_IP: ${GUAC03_IP:?GUAC03_IP is required}
      SESSIONGUARD_IP: ${SESSIONGUARD_IP:?SESSIONGUARD_IP is required}
      GUAC_LB_SECRET: ${GUAC_LB_SECRET:?GUAC_LB_SECRET is required}
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:size=64m,noexec,nosuid,nodev
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
      - caddy-logs:/var/log/caddy

volumes:
  netbird-client:
  edgeguard-state:
  caddy-data:
  caddy-config:
  caddy-logs: