services:
  dc-amd-proxy:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: dc-amd-proxy
    image: nodedc/dc-amd-proxy:local
    restart: unless-stopped
    # Preserve the real AMD source address for the one-time pairing request.
    # The process itself binds only to the NAS LAN address below; this does not
    # change NAS routes, VPN, DNS, Tailscale, or any other host service.
    network_mode: host
    environment:
      PORT: "8790"
      DC_AMD_PROXY_BIND_ADDRESS: ${DC_AMD_PROXY_BIND_ADDRESS:-172.22.0.222}
      DC_AMD_CONNECTOR_HOST: ${DC_AMD_CONNECTOR_HOST:-172.22.0.183}
      DC_AMD_CONNECTOR_PORT: ${DC_AMD_CONNECTOR_PORT:-8791}
      DC_AMD_PAIR_ALLOWED_SOURCE: ${DC_AMD_PAIR_ALLOWED_SOURCE:-172.22.0.183}
      DC_AMD_CONNECTOR_TOKEN_FILE: /var/lib/dc-amd-proxy/connector-access
      DC_AMD_MAP_EGRESS_TOKEN_FILE: /run/nodedc-secrets/map-egress-proxy-token
      DC_AMD_BODY_IDLE_TIMEOUT_SECONDS: ${DC_AMD_BODY_IDLE_TIMEOUT_SECONDS:-30}
    volumes:
      - type: bind
        source: /volume1/docker/nodedc-platform/secrets/map-egress-proxy-token
        target: /run/nodedc-secrets/map-egress-proxy-token
        read_only: true
      - type: bind
        source: ./runtime
        target: /var/lib/dc-amd-proxy
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=8m
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test:
        - CMD-SHELL
        - >
          node -e "fetch('http://'+process.env.DC_AMD_PROXY_BIND_ADDRESS+':8790/healthz')
          .then(r => process.exit(r.ok ? 0 : 1))
          .catch(() => process.exit(1))"
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s