# Pangolin bestaat uit drie samenwerkende delen:
#
#   pangolin  het dashboard en de API — publiceert zelf niets
#   gerbil    de WireGuard-kant waar de tunnels van Newt binnenkomen; die heeft
#             de poorten, en Traefik deelt zijn netwerknamespace
#   traefik   de reverse proxy die de certificaten regelt
#
# Traefik draait met `network_mode: service:gerbil`. Dat is geen stijlkeuze: het
# verkeer moet door de WireGuard-interface van Gerbil heen, en die bestaat
# alleen binnen diens namespace.
services:
  << service_name >>:
    image: fosrl/pangolin:latest
    container_name: << service_name >>
    environment:
      - TZ=<< timezone >>
    volumes:
      - ./config:/app/config
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
      interval: 10s
      timeout: 10s
      retries: 15
    restart: unless-stopped

  << service_name >>-gerbil:
    image: fosrl/gerbil:latest
    container_name: << service_name >>-gerbil
    depends_on:
      << service_name >>:
        condition: service_healthy
    command:
      - --reachableAt=http://<< service_name >>-gerbil:3003
      - --generateAndSaveKeyTo=/var/config/key
      - --remoteConfig=http://<< service_name >>:3001/api/v1/gerbil/get-config
      - --reportBandwidthTo=http://<< service_name >>:3001/api/v1/gerbil/receive-bandwidth
    volumes:
      - ./config/:/var/config
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    ports:
      - "<< port_wireguard >>:51820/udp"
      - "<< port_gerbil >>:21820/udp"
      - "<< port_http >>:80"
      - "<< port_https >>:443"
    restart: unless-stopped

  << service_name >>-traefik:
    image: traefik:v3.6
    container_name: << service_name >>-traefik
    network_mode: service:<< service_name >>-gerbil
    depends_on:
      << service_name >>:
        condition: service_healthy
    command:
      - --configFile=/etc/traefik/traefik_config.yml
    volumes:
      - ./config/traefik:/etc/traefik:ro
      - ./config/letsencrypt:/letsencrypt
    restart: unless-stopped