---
version: "3.8"
# cc-ci ENVIRONMENTAL overlay for rustdesk-server — applies to ALL deploys (base + PR head).
#
# rustdesk-server has NO HTTP surface (hbbs/hbbr speak their own protobuf protocol on
# host-published 21115-21119; the stock traefik labels point at a dead :80). cc-ci's install
# tier gates on an HTTPS serving signal through Traefik, so this overlay adds a `status`
# sidecar serving exactly ONE real app artifact: hbbs's generated identity PUBLIC key at
# /id_ed25519.pub (mounted read-only from the shared rustdesk_data volume). The health gate
# then proves domain routing AND that hbbs booted far enough to mint its keypair. The private
# key and the sqlite peer DB in the same volume are never exposed: nginx serves only the
# exact .pub location, everything else 404s.
#
# Node-reality tweaks ONLY — no version-specific image pins, no changes to the app/signal
# services (the stock app's vestigial Host(`${DOMAIN}`) router on :80 is left untouched; the
# status router declares an explicit higher priority so it deterministically wins the tie).
services:
  status:
    image: nginx:1.31.8
    command:
      - sh
      - -c
      - |
        printf '%s\n' \
          'user root;' \
          'worker_processes 1;' \
          'error_log /dev/stderr warn;' \
          'pid /tmp/nginx.pid;' \
          'events { worker_connections 128; }' \
          'http { default_type text/plain; access_log off;' \
          '  server { listen 80;' \
          '    location = /id_ed25519.pub { alias /pub/id_ed25519.pub; }' \
          '    location / { return 404; }' \
          '  }' \
          '}' > /etc/nginx/nginx.conf
        exec nginx -g 'daemon off;'
    volumes:
      # rustdesk_data is owned root:0700 (hbbs's /root), and id_ed25519.pub is 0644 — workers
      # must run as root (user root; above) to traverse the volume dir. Read-only mount; the
      # private key (id_ed25519) and db_v2.sqlite3 are unreachable through the config above.
      - rustdesk_data:/pub:ro
    networks:
      - proxy
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.${STACK_NAME}-status.rule=Host(`${DOMAIN}`)"
        - "traefik.http.routers.${STACK_NAME}-status.entrypoints=web-secure"
        - "traefik.http.routers.${STACK_NAME}-status.tls.certresolver=${LETS_ENCRYPT_ENV}"
        # Explicit priority: the stock app router claims the same Host rule against a dead
        # :80 backend; without this the winner of the equal-default-priority tie is undefined.
        - "traefik.http.routers.${STACK_NAME}-status.priority=100"
        - "traefik.http.services.${STACK_NAME}-status.loadbalancer.server.port=80"