services:
  awg-profiler:
    build:
      context: .
    image: awg-profiler:latest
    container_name: awg-profiler
    restart: unless-stopped

    # ── Networking capabilities ──────────────────────────────────────────────
    # NET_ADMIN: create/configure the WG interface and load nft rules.
    # /dev/net/tun: the amneziawg-go userspace data plane needs a TUN device.
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    sysctls:
      net.ipv4.ip_forward: "1"

    ports:
      - "51820:51820/udp"           # AmneziaWG listen port (match SERVER_PUBLIC_PORT)
      - "127.0.0.1:8080:8080/tcp"   # management web UI — localhost only by default;
                                     # widen to "8080:8080" only after setting
                                     # AWG_WEB_USER/AWG_WEB_PASS below

    # ── Persistence ──────────────────────────────────────────────────────────
    volumes:
      - awg-data:/data                     # config, client registry, profiles, state
      - awg-etc:/etc/amnezia/amneziawg     # interface .conf + nft ruleset

    # ── Web UI auth (uncomment for anything beyond localhost/LAN) ─────────────
    # environment:
    #   AWG_WEB_USER: admin
    #   AWG_WEB_PASS: "change-me-to-a-long-password"

volumes:
  awg-data:
  awg-etc: