# Crafty Controller - Minecraft szerver kezelő webes felülettel
# Domain: ${SUBDOMAIN}.${DOMAIN}
# Database: None (file-based)
# RAM: ~256M (mem_limit: 2048M) | Pi-compatible: No
#
# Environment variables:
#   DOMAIN          - Your domain (e.g., demo-felhom.eu)

services:
  crafty-controller:
    image: registry.gitlab.com/crafty-controller/crafty-4:4.4.8
    container_name: crafty-controller
    restart: unless-stopped
    environment:
      - TZ=Europe/Budapest
    volumes:
      - crafty_backups:/crafty/backups
      - crafty_logs:/crafty/logs
      - crafty_servers:/crafty/servers
      - crafty_config:/crafty/app/config
      - crafty_import:/crafty/import
    networks:
      - traefik-public
    deploy:
      resources:
        limits:
          memory: 2048M
    healthcheck:
      test: ["CMD", "/usr/bin/python3", "-c", "import socket,ssl; ssl._create_unverified_context().wrap_socket(socket.create_connection(('127.0.0.1',8443),timeout=3)).close()"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.crafty-controller.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.crafty-controller.entrypoints=websecure"
      - "traefik.http.routers.crafty-controller.tls=true"
      - "traefik.http.routers.crafty-controller.tls.certresolver=letsencrypt"
      - "traefik.http.services.crafty-controller.loadbalancer.server.port=8443"
      # Crafty serves self-signed HTTPS on :8443 (no plain-HTTP panel) — Traefik must speak https to the
      # backend and skip verifying the per-container self-signed cert (named transport defined in the
      # controller-managed traefik dynamic config; verification stays ON for all other backends).
      - "traefik.http.services.crafty-controller.loadbalancer.server.scheme=https"
      - "traefik.http.services.crafty-controller.loadbalancer.serverstransport=insecure-skip-verify@file"

volumes:
  crafty_backups:
  crafty_config:
  crafty_import:
  crafty_logs:
  crafty_servers:

networks:
  traefik-public:
    external: true