# ==================================================================
# GoodComms Server - Docker Compose
# ==================================================================
# Three deployment modes are supported. Uncomment the one you need.
#
# Mode A: Reverse Proxy (Caddy/Nginx handles TLS)     -- RECOMMENDED
# Mode B: Standalone Self-Signed (quick LAN/testing)
# Mode C: Standalone Manual TLS (bring your own certs)
#
# Docker Versioning:
# - Pin to a specific version (e.g., goodcomms/gc-server:0.9.97) for stability
# - Use goodcomms/gc-server:latest to always get the newest release
# - After each release, push both: docker push goodcomms/gc-server:v && docker push goodcomms/gc-server:latest
# ==================================================================

# ╔════════════════════════════════════════════════════════════════╗
# ║  MODE A: REVERSE PROXY (Caddy / Nginx)                       ║
# ║  The proxy handles TLS termination. GoodComms listens on     ║
# ║  plaintext TCP 4076 internally. UDP media ports are exposed   ║
# ║  directly for low latency.                                    ║
# ╚════════════════════════════════════════════════════════════════╝
services:
  goodcomms-server:
    image: goodcomms/gc-server:latest
    container_name: gc-server
    restart: unless-stopped
    networks:
      - proxy-network
    ports:
      # Media Ports (UDP): Exposed directly for low latency
      - "4077:4077/udp" # Voice
      - "4078:4078/udp" # Video
      # Note: TCP 4076 is NOT exposed; the proxy reaches it via proxy-network
    environment:
      - IP_ADDR=0.0.0.0
      - PORT=4076          # Internal TCP port for proxy to forward to
      - VOICE_PORT=4077
      - VIDEO_PORT=4078
      - NO_TLS=true        # Proxy handles TLS — critical
      - TRUST_PROXY=true   # Rate-limit/ban real client IPs (X-Forwarded-For) — critical behind a proxy
      - DATABASE_PATH=/app/data/goodcomms.db
      - STORAGE_DIR=/app/uploads
      - DRIVE_DIR=/app/drive
      - RETENTION_DAYS=0
      # --- Logging ---
      - LOG_DIR=/app/logs
      - LOG_MAX_SIZE_MB=50  # Rotate after 50 MB
      - LOG_MAX_FILES=5     # Keep 5 rotated files (~250 MB max)
      # - GIPHY_API_KEY=your_key_here
      # - KLIPY_API_KEY=your_key_here
      # - ADMIN_USER=admin       # Set on first run to bootstrap admin account
      # - ADMIN_PASS=changeme    # Set on first run to bootstrap admin account
    volumes:
      - ./data:/app/data
      - ./uploads:/app/uploads
      - ./drive:/app/drive
      - ./logs:/app/logs

networks:
  proxy-network:
    external: true

# ╔════════════════════════════════════════════════════════════════╗
# ║  MODE B: STANDALONE SELF-SIGNED                               ║
# ║  GoodComms auto-generates self-signed certs on first run.     ║
# ║  Good for LAN, home servers, or quick testing.                ║
# ║  Clients connecting via raw IP will accept self-signed certs. ║
# ╚════════════════════════════════════════════════════════════════╝
# services:
#   goodcomms-server:
#     image: goodcomms/gc-server:latest
#     container_name: gc-server
#     restart: unless-stopped
#     ports:
#       - "443:443"          # HTTPS (WebSocket + HTTP)
#       - "80:80"            # HTTP redirect → HTTPS
#       - "4077:4077/udp"    # Voice
#       - "4078:4078/udp"    # Video
#     environment:
#       - IP_ADDR=0.0.0.0
#       - PORT=443
#       - HTTP_PORT=80
#       - VOICE_PORT=4077
#       - VIDEO_PORT=4078
#       # NO_TLS is false by default — self-signed certs auto-generated
#       - DATABASE_PATH=/app/data/goodcomms.db
#       - STORAGE_DIR=/app/uploads
#       - DRIVE_DIR=/app/drive
#       - RETENTION_DAYS=0
#       - LOG_DIR=/app/logs
#       - LOG_MAX_SIZE_MB=50
#       - LOG_MAX_FILES=5
#       # - GIPHY_API_KEY=your_key_here
#       # - KLIPY_API_KEY=your_key_here
#       # - ADMIN_USER=admin       # Set on first run
#       # - ADMIN_PASS=changeme    # Set on first run
#     volumes:
#       - ./data:/app/data       # Also stores auto-generated certs
#       - ./uploads:/app/uploads
#       - ./drive:/app/drive
#       - ./logs:/app/logs

# ╔════════════════════════════════════════════════════════════════╗
# ║  MODE C: STANDALONE MANUAL TLS                                ║
# ║  Provide your own PEM certificate and key files.              ║
# ║  Use with LetsEncrypt, Certbot, or any CA-signed certs.      ║
# ╚════════════════════════════════════════════════════════════════╝
# services:
#   goodcomms-server:
#     image: goodcomms/gc-server:latest
#     container_name: gc-server
#     restart: unless-stopped
#     ports:
#       - "443:443"          # HTTPS (WebSocket + HTTP)
#       - "80:80"            # HTTP redirect → HTTPS
#       - "4077:4077/udp"    # Voice
#       - "4078:4078/udp"    # Video
#     environment:
#       - IP_ADDR=0.0.0.0
#       - PORT=443
#       - HTTP_PORT=80
#       - VOICE_PORT=4077
#       - VIDEO_PORT=4078
#       - TLS_CERT_PATH=/app/certs/fullchain.pem
#       - TLS_KEY_PATH=/app/certs/privkey.pem
#       - DATABASE_PATH=/app/data/goodcomms.db
#       - STORAGE_DIR=/app/uploads
#       - DRIVE_DIR=/app/drive
#       - RETENTION_DAYS=0
#       - LOG_DIR=/app/logs
#       - LOG_MAX_SIZE_MB=50
#       - LOG_MAX_FILES=5
#       # - GIPHY_API_KEY=your_key_here
#       # - KLIPY_API_KEY=your_key_here
#       # - ADMIN_USER=admin       # Set on first run
#       # - ADMIN_PASS=changeme    # Set on first run
#     volumes:
#       - ./data:/app/data
#       - ./uploads:/app/uploads
#       - ./drive:/app/drive
#       - ./logs:/app/logs
#       - ./certs:/app/certs:ro  # Mount your cert files read-only
