services:
  # UI dashboard
  netbird-dashboard:
    image: netbirdio/dashboard:latest
    container_name: netbird-dashboard
    restart: unless-stopped
    networks: [netbird, proxy-net]
    ports:
      - '8088:80'
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.zazlab.freeddns.org
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.zazlab.freeddns.org
      # OIDC - using embedded IdP
      - AUTH_AUDIENCE=netbird-dashboard
      - AUTH_CLIENT_ID=netbird-dashboard
      - AUTH_CLIENT_SECRET=${AUTH_CLIENT_SECRET}
      - AUTH_AUTHORITY=https://netbird.zazlab.freeddns.org/oauth2
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email groups
      - AUTH_REDIRECT_URI=/nb-auth
      - AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
      # SSL
      - NGINX_SSL_PORT=443
      - LETSENCRYPT_DOMAIN=none
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Combined server (Management + Signal + Relay + STUN)
  netbird-server:
    image: netbirdio/netbird-server:latest
    container_name: netbird-server
    restart: unless-stopped
    networks: [netbird, proxy-net]
    ports:
      - '8089:80'
      - '3478:3478/udp'
    volumes:
      - /srv/docker/server/netbird/data:/var/lib/netbird
      - /srv/docker/server/netbird/config.yaml:/etc/netbird/config.yaml
    command: ["--config", "/etc/netbird/config.yaml"]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

networks:
  netbird:
  proxy-net:
    external: true