version: "3.7"

# Umbrel Lab Gateway - accesso esterno on-demand alle app (*.lab.solarpi.net)
services:
  app_proxy:
    environment:
      # Apertura locale da Umbrel (umbrel.local:8898), protetta dal login Umbrel
      APP_HOST: maxlab-gateway_net_1
      APP_PORT: 8080

  net:
    # Detiene la rete condivisa e pubblica la porta del gateway
    image: gitea.solarpi.net/truetype/lab-gateway:1.0.0
    command: ["net"]
    user: "1000:1000"
    restart: on-failure
    ports:
      - "8899:8080"

  proxy:
    image: caddy:2.10.2-alpine
    command: ["caddy", "run"]
    restart: on-failure
    network_mode: "service:net"

  core:
    image: gitea.solarpi.net/truetype/lab-gateway:1.0.0
    command: ["core"]
    user: "1000:1000"
    restart: on-failure
    network_mode: "service:net"
    volumes:
      - ${APP_DATA_DIR}/data:/data
    environment:
      BASE_DOMAIN: lab.solarpi.net
      TRUSTED_PROXIES: 10.6.133.122/32
      DEFAULT_TTL_MIN: "120"
      MAX_TTL_MIN: "1440"
      SELF_APP_ID: maxlab-gateway
      # Assistente del bot: LocalAI sulla stessa VM (lasciare LLM_MODEL vuoto per disattivarlo)
      LLM_URL: http://localai_api_1:8080/v1
      LLM_MODEL: qwen_qwen3-4b-instruct-2507
      LLM_TIMEOUT: "90"

  broker:
    # Unico servizio con accesso a Docker e app-data, in sola lettura
    image: gitea.solarpi.net/truetype/lab-gateway:1.0.0
    command: ["broker"]
    user: "0:0"
    restart: on-failure
    network_mode: "service:net"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ${APP_DATA_DIR}/..:/umbrel-app-data:ro
    environment:
      SELF_APP_ID: maxlab-gateway