services:
  caddy:
    image: ghcr.io/${GITHUB_REPOSITORY_OWNER}/stoat-caddy-waf:latest
    container_name: caddy-waf
    restart: always
    ports:
      - "80:80"
      - "443:443"
    environment:
      CADDY_EMAIL: ${CADDY_EMAIL}
      TURN_REALM: ${TURN_REALM}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config

  turn:
    image: ghcr.io/${GITHUB_REPOSITORY_OWNER}/stoat-turn-server:4.0.1
    container_name: turn-relay
    restart: always
    depends_on:
      - caddy
    network_mode: host
    environment:
      EXTERNAL_IP: ${STATIC_IP}
      TURN_REALM: ${TURN_REALM}
      TURN_SHARED_SECRET: ${TURN_SHARED_SECRET}
    volumes:
      - ./turn-server.toml:/etc/turn-server/config.toml.tmpl:ro
      - caddy_data:/caddy-certs:ro

volumes:
  caddy_data:
  caddy_config: