version: "3.4"

services:
  netmaker: # The Primary Server for running Netmaker
    container_name: netmaker
    image: gravitl/netmaker:v0.18.0
    restart: always
    volumes: # Volume mounts necessary for sql, coredns, and mqtt
      - dnsconfig:/root/config/dnsconfig
      - sqldata:/root/data
      - shared_certs:/etc/netmaker
    environment: # Necessary capabilities to set iptables when running in container
      BROKER_NAME: "broker.NETMAKER_BASE_DOMAIN" # The domain/host IP indicating the mq broker address
      SERVER_NAME: "NETMAKER_BASE_DOMAIN" # The base domain of netmaker
      SERVER_HOST: "SERVER_PUBLIC_IP" # Set to public IP of machine.
      SERVER_HTTP_HOST: "api.NETMAKER_BASE_DOMAIN" # Overrides SERVER_HOST if set. Useful for making HTTP available via different interfaces/networks.
      SERVER_API_CONN_STRING: "api.NETMAKER_BASE_DOMAIN:443"
      COREDNS_ADDR: "SERVER_PUBLIC_IP" # Address of the CoreDNS server. Defaults to SERVER_HOST
      DNS_MODE: "on" # Enables DNS Mode, meaning all nodes will set hosts file for private dns settings.
      API_PORT: "8081" # The HTTP API port for Netmaker. Used for API calls / communication from front end. If changed, need to change port of BACKEND_URL for netmaker-ui.
      REST_BACKEND: "on" # Enables the REST backend (API running on API_PORT at SERVER_HTTP_HOST). Change to "off" to turn off.
      DISABLE_REMOTE_IP_CHECK: "off" # If turned "on", Server will not set Host based on remote IP check. This is already overridden if SERVER_HOST is set. Turned "off" by default.
      TELEMETRY: "on" # Whether or not to send telemetry data to help improve Netmaker. Switch to "off" to opt out of sending telemetry.
      MASTER_KEY: "REPLACE_MASTER_KEY" # The admin master key for accessing the API. Change this in any production installation.
      CORS_ALLOWED_ORIGIN: "*" # The "allowed origin" for API requests. Change to restrict where API requests can come from with comma-separated URLs. ex:- https://dashboard.netmaker.domain1.com,https://dashboard.netmaker.domain2.com
      DISPLAY_KEYS: "on" # Show keys permanently in UI (until deleted) as opposed to 1-time display.
      DATABASE: "sqlite" # Database to use - sqlite, postgres, or rqlite
      NODE_ID: "netmaker-server-1" # used for HA - identifies this server vs other servers
      MQ_HOST: "mq"  # the address of the mq server. If running from docker compose it will be "mq". Otherwise, need to input address. If using "host networking", it will find and detect the IP of the mq container.
      MQ_PORT: "443" # the reachable port of MQ - change if external MQ port changes (port on proxy, not necessarily the one exposed in docker-compose)
      MQ_SERVER_PORT: "1883" # the reachable port of MQ by the server - change if internal MQ port changes (or use external port if MQ is not on the same machine)
      MQ_USERNAME: "REPLACE_MQ_USERNAME" # the username to set for MQ access
      MQ_PASSWORD: "REPLACE_MQ_PASSWORD" # the password to set for MQ access
      STUN_PORT: "3478" # the reachable port of STUN on the server
      VERBOSITY: "1" # logging verbosity level - 1, 2, or 3
      # this section is for OAuth
      AUTH_PROVIDER: "" # "<azure-ad|github|google|oidc>"
      CLIENT_ID: "" # "<client id of your oauth provider>"
      CLIENT_SECRET: "" # "<client secret of your oauth provider>"
      FRONTEND_URL: "" # "https://dashboard.<netmaker base domain>"
      AZURE_TENANT: "" # "<only for azure, you may optionally specify the tenant for the OAuth>"
      OIDC_ISSUER: "" # https://oidc.yourprovider.com - URL of oidc provider
    ports:
      - "3478:3478/udp" # the stun port
  netmaker-ui:  # The Netmaker UI Component
    container_name: netmaker-ui
    image: gravitl/netmaker-ui:v0.18.0
    depends_on:
      - netmaker
    links:
      - "netmaker:api"
    restart: always
    environment:
      BACKEND_URL: "https://api.NETMAKER_BASE_DOMAIN" # URL where UI will send API requests. Change based on SERVER_HOST, SERVER_HTTP_HOST, and API_PORT
  caddy: # The reverse proxy that manages traffic for Netmaker
    image: caddy:2.6.2
    container_name: caddy
    restart: unless-stopped
    volumes:
      - /root/Caddyfile:/etc/caddy/Caddyfile # Config file for Caddy
      - caddy_data:/data
      - caddy_conf:/config
    ports:
      - "80:80"
      - "443:443"
  coredns: # The DNS Server. CoreDNS can be removed unless doing special advanced use cases
    container_name: coredns
    image: coredns/coredns
    command: -conf /root/dnsconfig/Corefile
    depends_on:
      - netmaker
    restart: always
    volumes:
      - dnsconfig:/root/dnsconfig
  mq: # the mqtt broker for netmaker
    container_name: mq
    image: eclipse-mosquitto:2.0.15-openssl
    depends_on:
      - netmaker
    restart: unless-stopped
    command: ["/mosquitto/config/wait.sh"]
    environment:
      MQ_PASSWORD: "REPLACE_MQ_PASSWORD" # must be same value as in netmaker env 
      MQ_USERNAME: "REPLACE_MQ_USERNAME" # must be same value as in netmaker env
    volumes:
      - /root/mosquitto.conf:/mosquitto/config/mosquitto.conf
      - /root/wait.sh:/mosquitto/config/wait.sh
      - mosquitto_logs:/mosquitto/log
    ports:
      - "1883:1883"
      - "8883:8883"
volumes:
  caddy_data: {} # runtime data for caddy
  caddy_conf: {} # configuration file for Caddy
  shared_certs: {} # netmaker certs generated for MQ comms - used by nodes/servers
  sqldata: {} # storage for embedded sqlite
  dnsconfig: {} # storage for coredns
  mosquitto_logs: {} # storage for mqtt logs