services:
  dashboard:
    image: netbirdio/dashboard:latest
    restart: unless-stopped
    ports:
      - 10080:80
      - 10443:443
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.<redacted>.net
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.<redacted>.net
      - AUTH_AUDIENCE=netbird-client
      - AUTH_CLIENT_ID=netbird-client
      - AUTH_AUTHORITY=https://kc.<redacted>.net/realms/<redacted>_sso
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
      - AUTH_REDIRECT_URI=/auth/callback
      - AUTH_SILENT_REDIRECT_URI=/auth/silent-callback
      - NETBIRD_TOKEN_SOURCE=accessToken
      - NGINX_SSL_PORT=443
      - NETBIRD_DISABLE_LETSENCRYPT=true
      - NETBIRD_DOMAIN=netbird.<redacted>.net
    volumes:
      - /etc/letsencrypt:/etc/letsencrypt/
    networks:
      - my_network
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Signal
  signal:
    image: netbirdio/signal:latest
    restart: unless-stopped
    volumes:
      - netbird-signal:/var/lib/netbird
    environment:
      - NETBIRD_SIGNAL_PORT=443
    networks:
      - my_network
    ports:
      - 10000:80
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Relay
  relay:
    image: netbirdio/relay:latest
    restart: unless-stopped
    environment:
    - NB_LOG_LEVEL=info
    - NB_LISTEN_ADDRESS=:33080
    - NB_EXPOSED_ADDRESS=rel://netbird.<redacted>.net:33080
    # todo: change to a secure secret
    - NB_AUTH_SECRET=<redacted>
    ports:
      - 33080:33080
    networks:
      - my_network
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Management
  management:
    image: netbirdio/management:latest
    restart: unless-stopped
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      
      - /etc/letsencrypt:/etc/letsencrypt:ro
      - /root/netbird/config/management.json:/etc/netbird/management.json

    networks:
      - my_network
    ports:
      - 33073:443 #API port
    command: [
      "--port", "443",
      "--log-file", "console",
      "--log-level", "info",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=netbird.<redacted>.net",
      "--dns-domain=netbird.selfhosted"
      ]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
    environment:
      - NETBIRD_DISABLE_LETSENCRYPT=true
      - NETBIRD_DOMAIN=netbird.<redacted>.net
      - NETBIRD_MGMT_API_PORT=80
      - NETBIRD_STORE_ENGINE_POSTGRES_DSN=
      - NETBIRD_STORE_ENGINE_MYSQL_DSN=

  # Coturn
  coturn:
    image: coturn/coturn:latest
    restart: unless-stopped
    #domainname: netbird.<redacted>.net # only needed when TLS is enabled
    volumes:
      - /root/netbird/config/turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    environment:
      - TURN_MIN_PORT=49152
      - TURN_MAX_PORT=65535
    command:
      - -c /etc/turnserver.conf
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

volumes:
  netbird-mgmt:
  netbird-signal:
  #netbird-letsencrypt:


networks:
  my_network:
    external: true
    name: "my_network"