services:
  ts6-webview:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: ts6-webview
    restart: unless-stopped
    env_file:
      - .env
    # Share the host's network stack so 127.0.0.1 reaches the TeamSpeak server
    # (WebQuery 8443, voice 9987/udp) running on the host. `ports:` is ignored
    # in host mode, so the app binds directly on the host instead.
    network_mode: host
    # Connect to TeamSpeak by its certificate name (TS_HOST=chat.moekyun.me) but
    # resolve it to this machine, so WebQuery TLS verification passes and voice
    # UDP stays on loopback instead of hairpinning through the public IP.
    extra_hosts:
      - "chat.moekyun.me:127.0.0.1"
    environment:
      # Listen on loopback only; expose it through Nginx / Caddy on the host.
      WEB_HOST: "127.0.0.1"
      WEB_PORT: "5000"
      # Set to true when running behind Nginx / Caddy on the same host so
      # per-IP rate limits use X-Forwarded-For instead of the proxy IP.
      VOICE_TRUST_PROXY: "true"
    volumes:
      - ./config.toml:/app/config.toml:ro
      - ./static:/app/static:ro
    # Optional resource cap for small arm64 SBCs
    deploy:
      resources:
        limits:
          memory: 256M