services:
  controller:
    build:
      context: .
      args:
        CONTROLLER_UID: ${CONTROLLER_UID:-1000}
        CONTROLLER_GID: ${CONTROLLER_GID:-1000}
    image: video-player-controller:local
    container_name: yt-controller
    restart: unless-stopped
    init: true
    read_only: true
    ports:
      - "${CONTROLLER_WEB_PORT:-7531}:7531"
    environment:
      FLASK_SECRET_KEY: ${FLASK_SECRET_KEY:?Set FLASK_SECRET_KEY in .env}
      MQTT_HOST: ${MQTT_HOST:-10.40.0.2}
      MQTT_PORT: ${MQTT_PORT:-1883}
      MQTT_USERNAME: ${MQTT_USERNAME:-}
      MQTT_PASSWORD: ${MQTT_PASSWORD:-}
      MQTT_CLIENT_ID: ${MQTT_CLIENT_ID:-yt-controller}
      PORT: 7531
      YTPLAYER_DATA_BASE: /controller-data
      YTPLAYER_MEDIA_BASE: /mnt/Media/YTPlayer
      YTPLAYER_COOKIE_PATH: /run/secrets/yt-dlp-cookies.txt
    volumes:
      - ${CONTROLLER_DATA_DIR:?Set CONTROLLER_DATA_DIR in .env}:/controller-data
      - ${YTPLAYER_MEDIA_DIR:-/mnt/Media/YTPlayer}:/mnt/Media/YTPlayer
      - ./config.yaml:/app/config.yaml:ro
      # Optional: place yt-dlp-cookies.txt in this host directory.
      - type: bind
        source: ${CONTROLLER_SECRETS_DIR:-./secrets}
        target: /run/secrets
        read_only: true
    tmpfs:
      - /tmp:rw,nosuid,nodev,noexec,mode=1777,size=256m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - >-
          import urllib.request;
          urllib.request.urlopen('http://127.0.0.1:7531/healthz', timeout=3).read()
      interval: 30s
      timeout: 5s
      start_period: 30s
      retries: 3
    stop_grace_period: 45s
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"
    networks:
      - tabernet

networks:
  tabernet:
    external: true