services:
  icecast:
    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/icecast:latest
    build: ./icecast
    restart: unless-stopped
    network_mode: host
    environment:
      # :? not :- — a missing password must stop the stack, not silently
      # become a credential that is published in this file.
      ICECAST_SOURCE_PASSWORD: ${ICECAST_SOURCE_PASSWORD:?set ICECAST_SOURCE_PASSWORD in .env (run setup.sh, or openssl rand -base64 24)}
      ICECAST_ADMIN_PASSWORD: ${ICECAST_ADMIN_PASSWORD:?set ICECAST_ADMIN_PASSWORD in .env (run setup.sh, or openssl rand -base64 24)}

  # No `ports:` here — network_mode: host makes it a no-op either way. The
  # control API (:8001) and OP25's HTTP terminal (:8081) are unauthenticated,
  # so they bind 127.0.0.1 by default (see OP25_DEBUG_EXPOSE in .env.example)
  # rather than being exposed. edge-node still reaches both over localhost
  # because it shares this host network namespace.
  op25:
    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/op25-client:stable
    build: ./op25-container
    restart: unless-stopped
    privileged: true
    network_mode: host
    env_file: .env
    volumes:
      - ./configs:/configs
      - /dev:/dev
      - ./op25-container/app:/app
      - pulse_socket:/run/pulse
    environment:
      PULSE_SERVER: unix:/run/pulse/native
    depends_on:
      - icecast

  # Claims the node's SECOND physical SDR (op25 always claims the first).
  # Only useful if secondary_sdr_mode is set to adsb|ais via the edge-node
  # config; otherwise it just sits idle answering /secondary/status. See
  # node-26#9. Same network/device access as op25 for the same reason: it
  # needs the raw USB device, not a virtualized one.
  secondary-sdr:
    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/secondary-sdr:latest
    build: ./secondary-sdr-container
    restart: unless-stopped
    privileged: true
    network_mode: host
    env_file: .env
    volumes:
      - /dev:/dev

  edge-node:
    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/edge-node:latest
    build: ./drb-edge-node
    restart: unless-stopped
    network_mode: host
    env_file: .env
    volumes:
      - ./configs:/configs
      - ./recordings:/recordings
      - ./drb-edge-node/app:/app/app
      - pulse_socket:/run/pulse
    environment:
      PULSE_SERVER: unix:/run/pulse/native
    depends_on:
      - icecast
      - op25

volumes:
  pulse_socket: