services:
  device-edge-backhaul:
    build:
      context: .
      dockerfile: services/device-edge-backhaul/Dockerfile
    image: nodedc/device-edge-backhaul:local
    pull_policy: never
    restart: unless-stopped
    user: "1000:1000"
    read_only: true
    tmpfs:
      - /tmp:size=8m,mode=1777
    volumes:
      - ../secrets/backhaul/id_ed25519:/run/keys/edge-to-synology:ro
      - ../trust/synology-backhaul-known_hosts:/run/trust/known_hosts:ro
    command:
      - -N
      - -T
      - -p
      - "2222"
      - -i
      - /run/keys/edge-to-synology
      - -L
      - 0.0.0.0:19921:127.0.0.1:9921
      - -o
      - BatchMode=yes
      - -o
      - PasswordAuthentication=no
      - -o
      - KbdInteractiveAuthentication=no
      - -o
      - PubkeyAuthentication=yes
      - -o
      - IdentitiesOnly=yes
      - -o
      - StrictHostKeyChecking=yes
      - -o
      - UserKnownHostsFile=/run/trust/known_hosts
      - -o
      - UpdateHostKeys=no
      - -o
      - ExitOnForwardFailure=yes
      - -o
      - ServerAliveInterval=15
      - -o
      - ServerAliveCountMax=3
      - -o
      - TCPKeepAlive=yes
      - -o
      - LogLevel=VERBOSE
      - -o
      - ProxyCommand=nc -X 5 -x nodedc-device-edge-tailnet-1:1055 %h %p
      - device-backhaul@100.109.216.21
    networks:
      - device-edge-private
      - device-edge-tailnet
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    pids_limit: 32
    healthcheck:
      test:
        - CMD
        - nc
        - -z
        - -w
        - "3"
        - 127.0.0.1
        - "19921"
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 10s

networks:
  device-edge-private:
    name: nodedc-device-edge-private
    external: true
  device-edge-tailnet:
    name: nodedc-device-edge-tailnet
    external: true