services:
  rust-package-builder:
    build:
      context: .
      args:
        FREEBSD_RELEASE: "${FREEBSD_RELEASE:-15.1-RELEASE}"
        FREEBSD_RUST_TOOLCHAIN: "${FREEBSD_RUST_TOOLCHAIN:-1.88.0}"
    image: linuxiarz/rust-package-builder:latest
    environment:
      SOURCE_REPO: "${SOURCE_REPO:?SOURCE_REPO is required}"
      SOURCE_BRANCH: "${SOURCE_BRANCH:-master}"
      REPOSITORY_URL: "${REPOSITORY_URL:?REPOSITORY_URL is required}"
      OPNSENSE_REPOSITORY_URL: "${OPNSENSE_REPOSITORY_URL:?OPNSENSE_REPOSITORY_URL is required}"
      POLL_INTERVAL: "${POLL_INTERVAL:-300}"
      REPO_DISTRIBUTION: "${REPO_DISTRIBUTION:-stable}"
      REPO_COMPONENT: "${REPO_COMPONENT:-main}"
      PACKAGE_RELEASE: "${PACKAGE_RELEASE:-auto}"
      MAX_GLIBC_VERSION: "${MAX_GLIBC_VERSION:-2.34}"
      KEEP_WORKSPACE: "${KEEP_WORKSPACE:-0}"
      OPNSENSE_ABI: "${OPNSENSE_ABI:-26.7}"
      OPNSENSE_RETENTION: "${OPNSENSE_RETENTION:-10}"
      FREEBSD_RELEASE: "${FREEBSD_RELEASE:-15.1-RELEASE}"
      FREEBSD_ABI: "${FREEBSD_ABI:-FreeBSD:15:amd64}"
      FREEBSD_ARCH: "${FREEBSD_ARCH:-freebsd:15:x86:64}"
      FREEBSD_RUST_TOOLCHAIN: "${FREEBSD_RUST_TOOLCHAIN:-1.88.0}"
      APPLY_FREEBSD_PATCHES: "${APPLY_FREEBSD_PATCHES:-1}"
      RUN_LINUX_TESTS: "${RUN_LINUX_TESTS:-1}"
      FREEBSD_NATIVE_ENABLED: "${FREEBSD_NATIVE_ENABLED:-1}"
      FREEBSD_NATIVE_RETENTION: "${FREEBSD_NATIVE_RETENTION:-10}"
    volumes:
      - ./data:/var/lib/package-builder
      - ./gpg:/run/secrets/gpg:ro
    restart: unless-stopped

  repository-dashboard:
    build:
      context: ./dashboard
    image: rustproxy/repository-dashboard:local
    environment:
      REPOSITORY_ROOT: /srv/repository
      REPOSITORY_URL: "${REPOSITORY_URL:?REPOSITORY_URL is required}"
      OPNSENSE_REPOSITORY_URL: "${OPNSENSE_REPOSITORY_URL:?OPNSENSE_REPOSITORY_URL is required}"
      REPO_DISTRIBUTION: "${REPO_DISTRIBUTION:-stable}"
      REPO_COMPONENT: "${REPO_COMPONENT:-main}"
    volumes:
      - ./data/repository:/srv/repository:ro
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped

  repository-http:
    depends_on:
      - repository-dashboard
    image: nginxinc/nginx-unprivileged:stable-alpine-slim
    ports:
      - "0.0.0.0:${HTTP_PORT:-18765}:8080"
      - "0.0.0.0:${OPNSENSE_HTTP_PORT:-18766}:8081"
    volumes:
      - ./data/repository:/srv/repository:ro
      - ./http/nginx.conf:/etc/nginx/nginx.conf:ro
    entrypoint: ["nginx", "-g", "daemon off;"]
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=16m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped