services:
  control-plane:
    build: ./control_plane
    # Always build from this checkout — never pull a registry image that may
    # be older than the code you just pulled. The image name below only
    # matters for `docker stack deploy` (Swarm can't build; see the Swarm
    # caveats in README.md), which pulls what CI publishes on every push to
    # master (`latest` plus the short commit sha).
    pull_policy: build
    image: ${GATEWAY_CONTROL_PLANE_IMAGE:-forgejo.sourcegate.online/robert/furtka-gateway-control-plane:latest}
    container_name: furtka-gateway-control-plane
    environment:
      - GATEWAY_MODE=${GATEWAY_MODE:-single}
      - GATEWAY_STATE_DIR=/data
      - GATEWAY_DYNAMIC_DIR=/dynamic
      - GATEWAY_ADMIN_TOKEN=${GATEWAY_ADMIN_TOKEN}
      - GATEWAY_BOX_TOKEN=${GATEWAY_BOX_TOKEN}
      # Blank means no explicit resolver (`tls: {}`) — Traefik applies
      # whatever default TLS is already configured on YOUR Traefik. Set
      # this to your Traefik's certResolver name if it doesn't have one.
      - GATEWAY_CERT_RESOLVER=${GATEWAY_CERT_RESOLVER:-}
      # Your existing wg-easy's admin API — reachable at whatever
      # host:port makes sense for your setup (a sibling container on the
      # network this joins — see `networks:` below — or a real host:port
      # if it's elsewhere). See the README's Prerequisites checklist for
      # the network-reachability requirement this doesn't (can't)
      # automate away.
      - WG_EASY_URL=${WG_EASY_URL}
      - WG_EASY_ADMIN_PASSWORD=${WG_EASY_ADMIN_PASSWORD}
      # "14" (default) or "15" — these are different, incompatible APIs
      # (see control_plane/wgeasy.py vs wgeasy_v15.py's module docstrings).
      # Check which one your wg-easy image tag actually is.
      - WG_EASY_API_VERSION=${WG_EASY_API_VERSION:-14}
      # v15 only: the admin user's username (v14 has no username concept —
      # see WG_EASY_ADMIN_PASSWORD above).
      - WG_EASY_ADMIN_USERNAME=${WG_EASY_ADMIN_USERNAME:-}
      # v15 only: restricts new clients' AllowedIPs to your wg-easy peer
      # subnet (v15 defaults new clients to full-tunnel 0.0.0.0/0, ::/0
      # otherwise — see wgeasy_v15.py's restrict_default_allowed_ips()).
      - GATEWAY_WG_ALLOWED_IPS=${GATEWAY_WG_ALLOWED_IPS:-10.8.0.0/24}
    volumes:
      - control_plane_data:/data
      # Bind-mount this at whatever host path YOUR Traefik's file provider
      # already watches (or add a second `providers.file` directory to
      # your Traefik's static config pointed at this same path — additive,
      # doesn't touch your existing dynamic config). Default here is just
      # a placeholder; ops/deploy.sh asks for the real path.
      - ${GATEWAY_DYNAMIC_DIR_HOST:-./dynamic}:/dynamic
    ports:
      # Loopback-only by default. This is how a remote Furtka box reaches
      # the registration API in the COMMON case (your own Traefik, on the
      # network below, proxies to it — see
      # traefik/dynamic/control-plane.yml.example) — a public bind here
      # isn't needed. Only widen GATEWAY_CONTROL_PLANE_BIND if your
      # Traefik genuinely can't join this container's docker network (a
      # separate-host setup) — ops/deploy.sh flags the access-control
      # implication of doing that when you choose it.
      - "${GATEWAY_CONTROL_PLANE_BIND:-127.0.0.1:8090}:8090"
    restart: unless-stopped
    # No `networks:` here on purpose — your Traefik's network name differs
    # per setup. ops/deploy.sh writes a gitignored
    # docker-compose.override.yaml (auto-loaded by `docker compose`) that
    # joins this container to it from the first second.

volumes:
  control_plane_data: