# Image tags: a provisioned node pins every image to the source tree it has
# checked out (DRB_TAG_* = src-<git tree hash>, written into .env by install.sh
# and scripts/drb-update.sh via scripts/image-tags.sh — node-26#19). Unset, as
# in local dev, they fall back to :latest / :stable, which CI builds from main.
services:
  icecast:
    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/icecast:${DRB_TAG_ICECAST:-latest}
    build: ./icecast
    restart: unless-stopped
    network_mode: host
    environment:
      # :? not :- — a missing password must stop the stack, not silently
      # become a credential that is published in this file.
      ICECAST_SOURCE_PASSWORD: ${ICECAST_SOURCE_PASSWORD:?set ICECAST_SOURCE_PASSWORD in .env (run setup.sh, or openssl rand -base64 24)}
      ICECAST_ADMIN_PASSWORD: ${ICECAST_ADMIN_PASSWORD:?set ICECAST_ADMIN_PASSWORD in .env (run setup.sh, or openssl rand -base64 24)}

  # No `ports:` here — network_mode: host makes it a no-op either way. The
  # control API (:8001) and OP25's HTTP terminal (:8081) are unauthenticated,
  # so they bind 127.0.0.1 by default (see OP25_DEBUG_EXPOSE in .env.example)
  # rather than being exposed. edge-node still reaches both over localhost
  # because it shares this host network namespace.
  op25:
    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/op25-client:${DRB_TAG_OP25:-stable}
    build: ./op25-container
    restart: unless-stopped
    privileged: true
    network_mode: host
    env_file: .env
    volumes:
      - ./configs:/configs
      - /dev:/dev
      - ./op25-container/app:/app
      - pulse_socket:/run/pulse
    environment:
      PULSE_SERVER: unix:/run/pulse/native
    depends_on:
      - icecast

  # Claims the node's SECOND physical SDR (op25 always claims the first).
  # Only useful if secondary_sdr_mode is set to adsb|ais via the edge-node
  # config; otherwise it just sits idle answering /secondary/status. See
  # node-26#9. Same network/device access as op25 for the same reason: it
  # needs the raw USB device, not a virtualized one.
  secondary-sdr:
    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/secondary-sdr:${DRB_TAG_SECONDARY_SDR:-latest}
    build: ./secondary-sdr-container
    restart: unless-stopped
    privileged: true
    network_mode: host
    env_file: .env
    volumes:
      - /dev:/dev

  # Trunk Recorder (node-26#45) — the alternative recorder. Opt-in per node:
  # it only starts when the node's .env has COMPOSE_PROFILES=trunk-recorder,
  # and the edge-node only uses it with RECORDER_BACKEND=trunk-recorder. Set
  # both or neither. Upstream image, pinned by tag AND digest (the digest is
  # the multi-arch index for 5.2.1 on Docker Hub, amd64/arm64/arm/v7); bump
  # both together. GPL-3.0: we ship it unmodified as a separate program —
  # see trunk-recorder/README.md for the source offer.
  #
  # The edge-node writes ./configs/trunk-recorder/config.json; run.sh (our
  # supervisor, replacing the image's CMD) restarts TR when it changes. It
  # shares OP25's dongle slot, so op25 is never started on such a node.
  trunk-recorder:
    image: robotastic/trunk-recorder:5.2.1@sha256:c3e425858bfca16c609d8612808a83f06b0f376d950d11733d7c25b2a28f8866
    profiles: ["trunk-recorder"]
    restart: unless-stopped
    network_mode: host
    devices:
      - /dev/bus/usb:/dev/bus/usb
    # TR stages each transmission in tempDir (/dev/shm); Docker's 64 MB
    # default is tight with several recorders running at once.
    shm_size: 256m
    entrypoint: ["/bin/sh", "/drb/run.sh"]
    environment:
      TZ: ${TZ:-UTC}
    volumes:
      - ./configs/trunk-recorder:/app
      - ./recordings:/recordings
      - ./trunk-recorder:/drb:ro

  edge-node:
    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/edge-node:${DRB_TAG_EDGE_NODE:-latest}
    build: ./drb-edge-node
    restart: unless-stopped
    network_mode: host
    env_file: .env
    volumes:
      - ./configs:/configs
      - ./recordings:/recordings
      - ./drb-edge-node/app:/app/app
      - pulse_socket:/run/pulse
    environment:
      PULSE_SERVER: unix:/run/pulse/native
    depends_on:
      - icecast
      - op25

volumes:
  pulse_socket: