services:
  # UI dashboard
  dashboard:
    image: netbirdio/dashboard:latest
    container_name: netbird-dashboard
    restart: unless-stopped
    networks: [netbird, proxy-net]
    ports:
      - '8088:80'
    env:
      # Endpoints
      NETBIRD_MGMT_API_ENDPOINT=https://netbird.zazlab.freeddns.org
      NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.zazlab.freeddns.org
      # OIDC - using embedded IdP
      AUTH_AUDIENCE=netbird-dashboard
      AUTH_CLIENT_ID=netbird-dashboard
      AUTH_CLIENT_SECRET=${AUTH_CLIENT_SECRET}
      AUTH_AUTHORITY=https://netbird.zazlab.freeddns.org/oauth2
      USE_AUTH0=false
      AUTH_SUPPORTED_SCOPES=openid profile email groups
      AUTH_REDIRECT_URI=/nb-auth
      AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
      # SSL
      NGINX_SSL_PORT=443
      # Letsencrypt
      LETSENCRYPT_DOMAIN=none
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Combined server (Management + Signal + Relay + STUN)
  netbird-server:
    image: netbirdio/netbird-server:latest
    container_name: netbird-server
    restart: unless-stopped
    networks: [netbird, proxy-net]
    ports:
      - '8089:80'
      - '3478:3478/udp'
    volumes:
      - /srv/docker/server/netbird/data:/var/lib/netbird
      - /srv/docker/server/netbird/config.yaml:/etc/netbird/config.yaml
    command: ["--config", "/etc/netbird/config.yaml"]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

networks:
  netbird:
  proxy-net:
    external: true