docker-compose.yml

# RustyNES — browser-netplay + RetroAchievements deployment bundle
#
# Four services wired together:
#   - signaling : the WebRTC signaling relay (ws://signaling:9000), built from
#                 the rustynes-netplay `signaling_server` example.
#   - ra-proxy  : the casual-only browser RetroAchievements auth proxy (ADR 0015)
#                 that injects RA's identity `User-Agent` server-side (browsers
#                 forbid scripts setting it). Env-driven; holds no RA secret.
#   - caddy     : a TLS-terminating reverse proxy that exposes the relay as
#                 wss://<DOMAIN>/ and the RA proxy as https://<DOMAIN>/ra/*
#                 (an https page cannot open a plain ws:// or fetch a plain http://).
#   - coturn    : a STUN + TURN server for NAT traversal (browsers point their
#                 RtcConfiguration iceServers at it via [netplay] stun_servers).
#
# Quick start (local, self-signed TLS via Caddy's internal CA):
#   cd deploy && DOMAIN=localhost docker compose up --build
# Public deploy: set DOMAIN to a real hostname with an A/AAAA record; Caddy then
# provisions a Let's Encrypt cert automatically. See deploy/README.md.

services:
  signaling:
    build:
      # Build context is the workspace root so the Dockerfile can copy the whole
      # cargo workspace (the example depends on the rustynes-netplay crate).
      context: ..
      dockerfile: deploy/Dockerfile
    image: rustynes-signaling:latest
    restart: unless-stopped
    # Not published directly — only Caddy reaches it, on the internal network.
    expose:
      - "9000"

  ra-proxy:
    build:
      # Build context is the workspace root so the Dockerfile can copy the
      # reference proxy stub from scripts/cheevos/.
      context: ..
      dockerfile: deploy/Dockerfile.raproxy
    image: rustynes-raproxy:latest
    restart: unless-stopped
    # Configured purely from env (no committed config file). The proxy holds NO
    # RA secret — it injects only the non-secret identity User-Agent and enforces
    # casual-only + the CORS allowlist. Substitute these in `.env` (see
    # deploy/.env.example):
    #   RA_USER_AGENT       — keep the leading `RustyNES/` token (RA allowlists by it)
    #   RA_ALLOWED_ORIGINS  — the page origin(s) hosting the wasm build (CSV)
    #   RA_UPSTREAM         — upstream RA origin (default https://retroachievements.org)
    #   RA_ENFORCE_CASUAL   — "1"/"true" (default) refuses hardcore awards
    environment:
      RA_PROXY_BIND: "0.0.0.0:8092"
      RA_USER_AGENT: ${RA_USER_AGENT:-RustyNES/0.0.0 rcheevos/0.0.0}
      RA_UPSTREAM: ${RA_UPSTREAM:-https://retroachievements.org}
      RA_ALLOWED_ORIGINS: ${RA_ALLOWED_ORIGINS:-https://doublegate.github.io}
      RA_ENFORCE_CASUAL: ${RA_ENFORCE_CASUAL:-1}
    # Not published directly — only Caddy reaches it, on the internal network.
    expose:
      - "8092"

  caddy:
    image: caddy:2
    restart: unless-stopped
    depends_on:
      - signaling
      - ra-proxy
    environment:
      # The public hostname Caddy serves wss:// on. `localhost` uses Caddy's
      # internal self-signed CA (good for a local two-tab test); a real domain
      # triggers automatic Let's Encrypt issuance.
      DOMAIN: ${DOMAIN:-localhost}
    ports:
      - "443:443"
      - "80:80"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config

  coturn:
    image: coturn/coturn:latest
    restart: unless-stopped
    # STUN/TURN needs host networking for the relay port range to work without
    # per-port mapping; on Linux this is simplest. (On Docker Desktop, map the
    # ports explicitly instead — see deploy/README.md.)
    network_mode: host
    volumes:
      - ./turnserver.conf:/etc/coturn/turnserver.conf:ro
    # Base config comes from turnserver.conf; the deploy-specific TURN credential
    # + advertised realm are passed as CLI flags from env vars so a maintainer
    # never hand-edits the conf file. CLI flags override the conf. Substitute
    # these in a `.env` next to this file (see deploy/README.md):
    #   TURN_USER (default rustynes), TURN_SECRET (default changeme), TURN_REALM.
    # If coturn sits behind 1:1 NAT and cannot self-detect its public address,
    # append another line here:  - "--external-ip=YOUR.PUBLIC.IP"
    command:
      - "-c"
      - "/etc/coturn/turnserver.conf"
      - "--user=${TURN_USER:-rustynes}:${TURN_SECRET:-changeme}"
      - "--realm=${TURN_REALM:-rustynes.local}"

volumes:
  caddy_data:
  caddy_config: