# NetDesk self-hosted stack: the signaling/relay/web server + a coturn TURN
# sidecar. One command to stand up a full self-hosted NetDesk:
#
#   cd docker && cp .env.example .env    # then edit .env (secrets)
#   docker compose up -d --build
#
# Terminate TLS at your reverse proxy (nginx/Caddy/Traefik) in front of :8443,
# or set ND_CERT/ND_KEY + mount the certs to run TLS in-process.
services:
  netdesk:
    build:
      context: ..                 # repo root, so the image can COPY server/
      dockerfile: docker/Dockerfile
    image: netdesk-server:latest
    restart: unless-stopped
    ports:
      - "${ND_PORT:-8443}:8443"   # HTTP/WS (put a TLS proxy in front for the internet)
    env_file: .env
    volumes:
      - netdesk-data:/data        # accounts.db, audit.log, files/ (ND_DATA_DIR)
    # If you enable in-process TLS, also mount your certs and set ND_CERT/ND_KEY:
    #   - ./certs:/certs:ro

  # Self-hosted TURN (use-auth-secret): the server mints 12h HMAC creds against
  # ND_TURN_SECRET, and peers relay through here when direct P2P can't punch NAT.
  # Set ND_TURN_HOST + ND_TURN_SECRET in .env (and TURN_REALM) to activate it.
  coturn:
    image: coturn/coturn:4.6.2
    restart: unless-stopped
    network_mode: host           # TURN needs the real host ports / relay range
    command:
      - -n
      - --use-auth-secret
      - --static-auth-secret=${ND_TURN_SECRET:-changeme}
      - --realm=${TURN_REALM:-netdesk.local}
      - --listening-port=3478
      - --tls-listening-port=5349
      - --min-port=49152
      - --max-port=65535
      - --no-cli
      - --fingerprint

volumes:
  netdesk-data: