docker-compose.yml

# Storage: SQLite on LUKS-encrypted host volume. Key in RAM only.
# Traffic: cloudflared outbound tunnel. No ports exposed.
# Backup: Litestream optional (--profile backup).

services:
  relay:
    build: .
    volumes:
      - /mnt/encrypted/relay:/data
    environment:
      - DB_PATH=/data/relay.db
      - PORT=8080
      # Media and pair-time snapshot blobs live under the persistent /data mount.
      # Keep the explicit absolute path: a relative default resolves under the
      # image workdir and can be ephemeral or unwritable, which would leave
      # snapshot rows referencing blobs that were never durably stored.
      - MEDIA_STORAGE_PATH=/data/media
      # Both flags are required for resumable uploads. Keep file writes opt-in;
      # when enabled, /data must persist both media and its sibling snapshot tree.
      - SNAPSHOT_FILE_BACKING_ENABLED=${SNAPSHOT_FILE_BACKING_ENABLED:-false}
      - SNAPSHOT_UPLOAD_ENABLED=${SNAPSHOT_UPLOAD_ENABLED:-false}
      # /metrics is served only to loopback peers when METRICS_TOKEN is empty
      # (the relay fails closed — it is never world-readable). To scrape from
      # an off-host Prometheus, set a real token: `export METRICS_TOKEN=$(openssl rand -hex 32)`
      # before `docker compose up`, then send it as `Authorization: Bearer <token>`.
      - METRICS_TOKEN=${METRICS_TOKEN:-}
      - RUST_LOG=${RUST_LOG:-info}
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  cloudflared:
    image: cloudflare/cloudflared:latest
    command: tunnel run
    environment:
      - TUNNEL_TOKEN=${CLOUDFLARE_TUNNEL_TOKEN}
    restart: unless-stopped
    depends_on:
      relay:
        condition: service_healthy

  node-exporter:
    image: prom/node-exporter:latest
    restart: unless-stopped
    pid: host
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    command:
      - '--path.procfs=/host/proc'
      - '--path.sysfs=/host/sys'
      - '--path.rootfs=/rootfs'

  litestream:
    image: litestream/litestream:latest
    profiles: ["backup"]
    volumes:
      - /mnt/encrypted/relay:/data
      - ./litestream.yml:/etc/litestream.yml
    environment:
      - LITESTREAM_ACCESS_KEY_ID=${B2_KEY_ID:-}
      - LITESTREAM_SECRET_ACCESS_KEY=${B2_APPLICATION_KEY:-}
    entrypoint: litestream
    command: replicate -config /etc/litestream.yml
    restart: unless-stopped
    depends_on:
      relay:
        condition: service_healthy