services:
  controller:
    image: node:24-alpine
    container_name: xiteng-edge-cache
    restart: unless-stopped
    command: ["node", "/app/controller.mjs"]
    environment:
      PORT: 8094
      DOCKER_SOCKET: /var/run/docker.sock
      OUTPUT_DIRECTORY: /dynamic
      STATE_DIRECTORY: /state
      DISCOVERY_INTERVAL_MS: 5000
      CLOUDFLARE_SYNC_INTERVAL_MS: 60000
      CLOUDFLARE_ZONE_NAME: xiteng.site
      CLOUDFLARE_ZONE_ID: c1cce0c846ccc0d2138b9b79c5e91e9f
      CLOUDFLARE_API_TOKEN_FILE: /run/secrets/cloudflare_cache_api_token
    volumes:
      - ./controller.mjs:/app/controller.mjs:ro
      - ./cloudflare.mjs:/app/cloudflare.mjs:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./dynamic:/dynamic
      - ./state:/state
      - ./secrets:/run/secrets:ro
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8094/healthz').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 5s
    labels:
      - "traefik.enable=false"
      - "xiteng.site.component.edge-cache.enabled=true"
      - "xiteng.site.component.edge-cache.name=Edge Cache Controller"
      - "xiteng.site.component.edge-cache.description=将服务声明的静态路径编译为 Traefik 路由与 Cloudflare Cache Rule。"
      - "xiteng.site.component.edge-cache.section=infrastructure"
      - "xiteng.site.component.edge-cache.category=边缘与网络"
      - "xiteng.site.component.edge-cache.access=internal"
      - "xiteng.site.component.edge-cache.access-label=仅容器网络"
      - "xiteng.site.component.edge-cache.icon=EC"
      - "xiteng.site.component.edge-cache.accent=blue"
      - "xiteng.site.component.edge-cache.order=115"
    networks:
      - homelab_net

networks:
  homelab_net:
    external: true