services:
  device-edge-relay:
    build:
      context: .
      dockerfile: services/device-edge-relay/Dockerfile
    image: nodedc/device-edge-relay:local
    pull_policy: never
    restart: unless-stopped
    user: "1000:1000"
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    environment:
      DEVICE_EDGE_RELAY_HEALTH_HOST: 127.0.0.1
      DEVICE_EDGE_RELAY_HEALTH_PORT: "18221"
      DEVICE_EDGE_RELAY_INGRESS_ENABLED: "false"
      DEVICE_EDGE_RELAY_TCP_PORT: "9921"
      DEVICE_EDGE_RELAY_MAX_SESSIONS: "100"
      DEVICE_EDGE_RELAY_MAX_SESSIONS_PER_ADDRESS: "10"
      DEVICE_EDGE_RELAY_MAX_CONNECTIONS_PER_MINUTE_PER_ADDRESS: "30"
      DEVICE_EDGE_RELAY_MAX_TRACKED_SOURCE_ADDRESSES: "2048"
      DEVICE_EDGE_RELAY_MAX_BYTES_PER_DIRECTION: "262144"
      DEVICE_EDGE_RELAY_SESSION_TIMEOUT_MS: "10000"
    networks:
      device-edge-private: {}
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - fetch('http://127.0.0.1:18221/healthz').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 10s

networks:
  device-edge-private:
    name: nodedc-device-edge-private
    internal: true