# Macmini WebDAV stack — exposes https://macmini.nixc.us (auth at tunnel).
# Server (ingress) is assumed configured for this domain and key.
#
# Auth: HTTP Basic at the tunnel. Set TUNNEL_AUTH_USER and TUNNEL_AUTH_PASS in .env (see .env.example); never commit .env.
# Connect in Finder: Go → Connect to Server → https://macmini.nixc.us
#
# What works:
#   - WebDAV: no auth in app; uploads go to ~/dev/piconfigurator/bin. Rebuild after app changes: --build.
#   - Tunnel: uses ~/.ssh/ca-userkey (same key as all other tunnel clients).
#   - network_mode: service:webdav so tunnel forwards to localhost:80 inside the webdav container.
#
services:
  webdav:
    build:
      context: .
      dockerfile: webdav/Dockerfile
    restart: always
    volumes:
      - ${HOME}/dev/piconfigurator/bin:/data

  tunnel-client:
    image: git.nixc.us/colin/better-argo-tunnels:client-production-arm64
    restart: always
    environment:
      TUNNEL_SERVER: "ingress.nixc.us:2222"
      TUNNEL_DOMAIN: "macmini.nixc.us"
      TUNNEL_PORT: "80"
      TUNNEL_KEY: "/keys/client_key"
      TUNNEL_AUTH_USER: "${TUNNEL_AUTH_USER}"
      TUNNEL_AUTH_PASS: "${TUNNEL_AUTH_PASS}"
    volumes:
      - ~/.ssh/ca-userkey:/keys/client_key:ro
    depends_on:
      - webdav
    network_mode: "service:webdav"