# Pulls the published multi-arch image instead of building from source.
# Copy .env.example to .env, set ADMIN_PASSWORD and SESSION_SECRET, then:
#   docker compose -f compose.release.yaml pull
#   docker compose -f compose.release.yaml up -d
services:
  site-gateway:
    image: ${SITE_GATEWAY_IMAGE:-ghcr.io/mfwadejr/site-gateway2:latest}
    container_name: site-gateway
    restart: unless-stopped
    environment:
      ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?Set ADMIN_PASSWORD in .env}
      SESSION_SECRET: ${SESSION_SECRET:?Set SESSION_SECRET in .env}
      ADMIN_PORT: 8080
      SITE_PORT_MIN: 9000
      SITE_PORT_MAX: 9099
      DATA_DIR: /data
      BACKUP_PASSWORD: ${BACKUP_PASSWORD:-}
      PUID: ${PUID:-1000}
      PGID: ${PGID:-1000}
      ACME_EMAIL: ${ACME_EMAIL:-}
    ports:
      - "${HTTP_PORT:-80}:80"
      - "${HTTPS_PORT:-443}:443"
      - "${HTTPS_PORT:-443}:443/udp"   # HTTP/3 (QUIC) — forward UDP 443 on your router/firewall too
      - "8080:8080"
      - "9000-9099:9000-9099"
      # Streaming Hosts (optional): add one line per TCP/UDP port you forward
      # from the dashboard, matching the target port you'll enter there.
      # - "25565:25565"
      # - "25565:25565/udp"
    volumes:
      - ${SITE_GATEWAY_DATA:-/DATA/AppData/site-gateway}:/data
      # Optional: enables "Pick from running containers" for Proxy and Streaming
      # host targets (Administration > Gateway defaults > Docker container selection).
      # Read-only, but be deliberate: access to the Docker socket is effectively root
      # on the host -- anything that can talk to it can start privileged containers and
      # mount the host filesystem. Leave this commented out unless you want the feature.
      # - /var/run/docker.sock:/var/run/docker.sock:ro
    labels:
      com.centurylinklabs.watchtower.enable: "true"