# Pulls the published multi-arch image instead of building from source.
# Copy .env.example to .env, set ADMIN_PASSWORD and SESSION_SECRET, then:
#   docker compose -f compose.release.yaml pull
#   docker compose -f compose.release.yaml up -d
services:
  site-gateway:
    image: ${SITE_GATEWAY_IMAGE:-git.us2plus2.com/marvin/site-gateway:latest}
    container_name: site-gateway
    restart: unless-stopped
    environment:
      ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?Set ADMIN_PASSWORD in .env}
      SESSION_SECRET: ${SESSION_SECRET:?Set SESSION_SECRET in .env}
      ADMIN_PORT: 8080
      SITE_PORT_MIN: 9000
      SITE_PORT_MAX: 9099
      DATA_DIR: /data
      BACKUP_PASSWORD: ${BACKUP_PASSWORD:-}
      PUID: ${PUID:-1000}
      PGID: ${PGID:-1000}
      ACME_EMAIL: ${ACME_EMAIL:-}
      # Optional: display-only Disk allowance for the resource panel. Set
      # DATA_DIR_LIMIT_GB in .env to use.
      DATA_DIR_LIMIT_GB: ${DATA_DIR_LIMIT_GB:-}
    # Optional but recommended: without a memory/CPU limit, the Dashboard and
    # Administration > System tab's live resource panel can only show usage
    # against the whole host. Uncomment and set in .env to give CPU/Memory a
    # real, container-scoped denominator (MEM_LIMIT, e.g. "2g"; CPU_LIMIT,
    # e.g. "2"; or CPUSET, e.g. "0,1", to pin cores instead of a count).
    # mem_limit: ${MEM_LIMIT}
    # cpus: ${CPU_LIMIT}
    # cpuset: ${CPUSET}
    ports:
      - "${HTTP_PORT:-80}:80"
      - "${HTTPS_PORT:-443}:443"
      - "${HTTPS_PORT:-443}:443/udp"   # HTTP/3 (QUIC) — forward UDP 443 on your router/firewall too
      - "8080:8080"
      - "9000-9099:9000-9099"
      # Streaming Hosts (optional): add one line per TCP/UDP port you forward
      # from the dashboard, matching the target port you'll enter there.
      # - "25565:25565"
      # - "25565:25565/udp"
    volumes:
      - ${SITE_GATEWAY_DATA:-/DATA/AppData/site-gateway}:/data
      # Optional: enables "Pick from running containers" for Proxy and Streaming
      # host targets (Administration > Gateway defaults > Docker container selection).
      # Read-only, but be deliberate: access to the Docker socket is effectively root
      # on the host -- anything that can talk to it can start privileged containers and
      # mount the host filesystem. Leave this commented out unless you want the feature.
      # - /var/run/docker.sock:/var/run/docker.sock:ro
    labels:
      com.centurylinklabs.watchtower.enable: "true"