# Deployed to Portainer (Swarm endpoint) by .gitea/workflows/deploy.yml.
# ${IMAGE} and the secrets below are injected as env_data at deploy time.
#
# Two constraints this stack cannot break:
#   1. exactly one replica — agent control sockets and live sessions are held in
#      process memory, so a second replica would not see the first one's agents;
#   2. pinned placement — the SQLite volume is node-local, so the task has to
#      come back to the same node or it wakes up with an empty database.
services:
  remote-control-support:
    image: ${IMAGE:-git.mancinas.io/rmancinas/remote-control-support-webapp:latest}
    ports:
      # 8091 is reserved on the Swarm ingress by ai-training-lab_ai-lab, and a
      # reservation holds even when nothing is answering on it — so this sits
      # well clear of the 809x block. 5910 is VNC display :10, which is at least
      # a hint about what is listening.
      - "5910:8080"
    environment:
      DB_PATH: /data/rcs.db
      TRUST_PROXY: "true"
      AUTH_URL: ${AUTH_URL:-http://192.168.4.208:8000}
      ADMIN_USERS: ${ADMIN_USERS:-}
      ADMIN_LEVEL: ${ADMIN_LEVEL:-}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-}
      PUBLIC_URL: ${PUBLIC_URL:-}
      ALLOW_SESSION_INVITES: ${ALLOW_SESSION_INVITES:-true}
    volumes:
      - rcs_data:/data
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
      update_config:
        # start-first would briefly run two containers against one SQLite file.
        order: stop-first
        failure_action: rollback
      restart_policy:
        condition: any
        delay: 10s

volumes:
  rcs_data: