services:
  ecs-controller:
    image: ${ECS_IMAGE_REPOSITORY:-docker.io/kori1c/ecs-controller}:${ECS_IMAGE_TAG:-latest}
    container_name: ecs-controller
    restart: unless-stopped
    ports:
      - "127.0.0.1:43211:8080"
    volumes:
      - controller_data:/var/lib/ecs-controller
      - update_state:/var/lib/ecs-controller/update
      - ./data:/migration-data:ro
    environment:
      TZ: Asia/Shanghai
      ECS_DATA_DIR: /var/lib/ecs-controller
      ECS_HTTP_ADDR: :8080
      ECS_SETUP_TOKEN: ${ECS_SETUP_TOKEN:-}
      ECS_COOKIE_SECURE: ${ECS_COOKIE_SECURE:-0}
      ECS_UPDATE_DIR: /var/lib/ecs-controller/update
      ECS_IMAGE_REPOSITORY: ${ECS_IMAGE_REPOSITORY:-docker.io/kori1c/ecs-controller}
    security_opt:
      - no-new-privileges:true

  # The application stays unprivileged. Only this helper can access Docker to
  # pull a prebuilt image after an authenticated request.
  ecs-controller-updater:
    image: ${ECS_UPDATER_IMAGE_REPOSITORY:-docker.io/kori1c/ecs-controller-updater}:${ECS_UPDATER_IMAGE_TAG:-latest}
    restart: unless-stopped
    environment:
      ECS_UPDATE_DIR: /update-state
      ECS_PROJECT_DIR: /workspace
      ECS_COMPOSE_PROJECT_NAME: ${ECS_COMPOSE_PROJECT_NAME:-ecs-controller}
      ECS_UPDATE_BRANCH: ${ECS_UPDATE_BRANCH:-main}
      ECS_COOKIE_SECURE: ${ECS_COOKIE_SECURE:-0}
      ECS_IMAGE_REPOSITORY: ${ECS_IMAGE_REPOSITORY:-docker.io/kori1c/ecs-controller}
      ECS_IMAGE_TAG: ${ECS_IMAGE_TAG:-latest}
    volumes:
      - .:/workspace:rw
      - update_state:/update-state
      - /var/run/docker.sock:/var/run/docker.sock

volumes:
  controller_data:
  update_state: