services:
  rmm-server:
    build:
      context: .
      dockerfile: Dockerfile
    environment:
      RMM_ADDR: ":8080"
      RMM_DB_PATH: /data/rmm.db
      RMM_WEB_DIR: /app/web
      RMM_INSECURE_DEV_MODE: "${RMM_INSECURE_DEV_MODE:-false}"
      RMM_ALLOW_LEGACY_ENROLLMENT: "${RMM_ALLOW_LEGACY_ENROLLMENT:-false}"
      RMM_ALLOW_LEGACY_LUCI_PROXY: "${RMM_ALLOW_LEGACY_LUCI_PROXY:-false}"
      RMM_ENROLLMENT_TOKEN: "${RMM_ENROLLMENT_TOKEN:-}"
      RMM_OPERATOR_TOKEN: "${RMM_OPERATOR_TOKEN:-}"
      RMM_OPERATOR_USERNAME: "${RMM_OPERATOR_USERNAME:-admin}"
      RMM_OPERATOR_PASSWORD: "${RMM_OPERATOR_PASSWORD:?set RMM_OPERATOR_PASSWORD in .env}"
      RMM_COOKIE_SECURE: "${RMM_COOKIE_SECURE:-true}"
      RMM_TUNNEL_HTTP_HOST: tunnel-ssh
      RMM_DEVICE_DOMAIN: "${RMM_DEVICE_DOMAIN:-}"
      RMM_PUBLIC_SCHEME: "${RMM_PUBLIC_SCHEME:-https}"
      RMM_METRIC_RETENTION_DAYS: "${RMM_METRIC_RETENTION_DAYS:-30}"
    ports:
      - "${RMM_HTTP_BIND_IP:-127.0.0.1}:${RMM_HTTP_PORT:-18080}:8080"
    volumes:
      - rmm-data:/data
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    mem_limit: 256m
    restart: unless-stopped

  tunnel-ssh:
    build:
      context: ./deploy/tunnel
    ports:
      - "${RMM_TUNNEL_BIND_IP:-0.0.0.0}:${RMM_TUNNEL_SSH_PORT:-2222}:22"
      - "${RMM_TUNNEL_OPERATOR_BIND_IP:-127.0.0.1}:22000-22099:22000-22099"
    volumes:
      - tunnel-data:/data
      - "${RMM_TUNNEL_KEY_PATH:-./secrets/router_tunnel_key.pub}:/bootstrap/router_tunnel_key.pub:ro"
    pids_limit: 128
    mem_limit: 128m
    restart: unless-stopped

volumes:
  rmm-data:
  tunnel-data: