version: "3.8"

services:
  wstunnel:
    image: ghcr.io/erebe/wstunnel:${WGTUNNEL_IMAGE_TAG}
    restart: unless-stopped
    # The image ENTRYPOINT is dumb-init; we override the command with the full
    # binary path so dumb-init execs it. `--restrict-to` is not in the image's
    # default CMD, so a full override is required.
    command:
      - /home/app/wstunnel
      - server
      - --restrict-to
      - ${WG_TARGET}
      - ws://0.0.0.0:${WSTUNNEL_PORT}
    networks:
      - traefik-net
    healthcheck:
      # The image is dash + grep/sed/cat only — no nc/wget/curl and dash has no
      # /dev/tcp (contract R5.4 "no usable probe binary" case). Verify the listener
      # via /proc/net/tcp instead: port 8080 = 0x1F90 (update if WSTUNNEL_PORT changes).
      test: ["CMD-SHELL", "grep -qi ':1F90 ' /proc/net/tcp /proc/net/tcp6 2>/dev/null || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik-net
      - "traefik.http.routers.wgtunnel.rule=Host(`${TUNNEL_HOST}`)"
      - traefik.http.routers.wgtunnel.entrypoints=websecure
      - traefik.http.routers.wgtunnel.tls=true
      - traefik.http.routers.wgtunnel.tls.certresolver=anaprod
      - traefik.http.services.wgtunnel.loadbalancer.server.port=${WSTUNNEL_PORT}

networks:
  traefik-net:
    external: true