# =============================================================================
# BetterDesk — Official Quick Start (Single Container, MACVLAN / shared LAN IP)
# =============================================================================
# Use when the stack must appear on your LAN with a dedicated IP (macvlan),
# not via host port mappings. All services run in one container on MACVLAN_IPV4.
#
# Prerequisites:
#   - External macvlan network already created on the Docker host (example below).
#   - A free IPv4 on that subnet (MACVLAN_IPV4).
#
# Create macvlan (once per host — adjust parent interface and subnet):
#   docker network create -d macvlan \
#     --subnet=192.168.1.0/24 --gateway=192.168.1.1 \
#     -o parent=eth0 LAN
#
# Usage:
#   export MACVLAN_IPV4=192.168.1.51
#   export RELAY_SERVERS=${MACVLAN_IPV4}:21117
#   curl -fsSL https://raw.githubusercontent.com/UNITRONIX/BetterDesk/main/docker-compose.quick.single.macvlan.yml -o docker-compose.yml
#   docker compose pull && docker compose up -d
#
# Web console: http://MACVLAN_IPV4:5000
# RustDesk client API: http://MACVLAN_IPV4:21121
# Admin password:
#   docker compose exec betterdesk betterdesk-show-admin-credentials
#
# Legacy split layout: docker-compose.quick.macvlan.yml
#
# Image tag (aligned with CHANGELOG / git tag):
#   Default: 3.3.112  |  Rolling: BETTERDESK_IMAGE_TAG=latest
# =============================================================================

services:
  betterdesk:
    image: ghcr.io/unitronix/betterdesk:${BETTERDESK_IMAGE_TAG:-3.5.4}
    container_name: betterdesk
    hostname: betterdesk
    volumes:
      - betterdesk-data:/opt/rustdesk
      - console-data:/app/data
    environment:
      - NODE_ENV=production
      - PORT=5000
      - HOST=0.0.0.0
      - API_HOST=0.0.0.0
      - API_ENABLED=false
      - ENCRYPTED_ONLY=1
      - SERVER_BACKEND=betterdesk
      - HBBS_API_URL=http://127.0.0.1:21121/api
      - BETTERDESK_API_URL=http://127.0.0.1:21121/api
      - RUSTDESK_PATH=/opt/rustdesk
      - DATA_DIR=/app/data
      - DB_PATH=/opt/rustdesk/db_v2.sqlite3
      - PUB_KEY_PATH=/opt/rustdesk/id_ed25519.pub
      - API_KEY_PATH=/opt/rustdesk/.api_key
      - DOCKER=true
      - BETTERDESK_UPDATE_MODE=image
      - BETTERDESK_DOCKER_LAYOUT=single
      - BETTERDESK_IMAGE_TAG=${BETTERDESK_IMAGE_TAG:-3.5.4}
      - AUTH_DB_PATH=/app/data/auth.db
      - INIT_ADMIN_USER=${ADMIN_USERNAME:-admin}
      - INIT_ADMIN_PASS=${ADMIN_PASSWORD:-}
      - DEFAULT_ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
      - DEFAULT_ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
      - RELAY_SERVERS=${RELAY_SERVERS:-}
      - SIGNAL_RATE_LIMIT_PER_IP=${SIGNAL_RATE_LIMIT_PER_IP:-20}
      - ENROLLMENT_MODE=${ENROLLMENT_MODE:-}
      - TZ=${TZ:-UTC}
    networks:
      lan:
        ipv4_address: ${MACVLAN_IPV4:?Set MACVLAN_IPV4 e.g. 192.168.1.51}
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - FOWNER
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://127.0.0.1:21121/api/health && curl -sf http://127.0.0.1:5000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 45s

networks:
  lan:
    name: ${MACVLAN_NETWORK:-LAN}
    external: true

volumes:
  betterdesk-data:
    name: betterdesk-data
  console-data:
    name: betterdesk-console-data