docker-compose.yml

services:



  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: cloudflared
    command: tunnel run
    env_file:
      - .env
    environment:
      TUNNEL_TOKEN_FILE: /run/secrets/tunnel_token
      CF_HOSTNAME: ${CF_HOSTNAME}
    restart: unless-stopped
    volumes:
      - ${DOCKER_HOST_PATH:-.}/secrets/tunnel_token.txt:/run/secrets/tunnel_token:ro,z
    networks:
      - internal
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true

  docker-socket-proxy:
    image: ghcr.io/grumpysdb/oscar-shareable-proxy:${DOCKER_IMAGE_TAG:-latest}
    container_name: docker-socket-proxy
    restart: unless-stopped
    volumes:
      - ${DOCKER_SOCKET_PATH:-/var/run/docker.sock}:/var/run/docker.sock:ro
    environment:
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - VOLUMES=1
      - POST=1
      - DELETE=1
    networks:
      - internal
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /tmp
      - /run

  nginx:
    image: ghcr.io/grumpysdb/oscar-shareable-nginx:${DOCKER_IMAGE_TAG:-latest}
    container_name: nginx-internal
    volumes:
      - ${DOCKER_HOST_PATH:-.}/nginx/nginx.conf.template:/etc/nginx/templates/oscar.conf.template:ro
      - ${DOCKER_HOST_PATH:-.}/certs:/etc/nginx/certs:ro
    expose:
      - "80"
      - "443"
    env_file:
      - .env
    # env_file provides the variables for envsubst to use in templates
    restart: unless-stopped
    networks:
      - internal
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /var/cache/nginx
      - /var/run
      - /tmp
      - /etc/nginx/conf.d

  uploader:
    container_name: uploader
    image: ghcr.io/grumpysdb/oscar-shareable-uploader:${DOCKER_IMAGE_TAG:-latest}
    expose:
      - "8080"
    group_add:
      - "952"
    env_file:
      - .env
    environment:
      HTTP_PORT: 8080
      UPLOAD_UID: 911
      UPLOAD_GID: 911
      OSCAR_BASE_URL: http://oscar:3000
      DATABASE_PATH: /app/data/uploads/db.sqlite
      DOCKER_HOST_PATH: ${DOCKER_HOST_PATH:-/opt/secure-uploader}
      DOCKER_HOST: tcp://docker-socket-proxy:2375
      OSCAR_PROFILE_VERSION: ${OSCAR_PROFILE_VERSION:-1.7.1+-plus}
      OSCAR_DOCKER_IMAGE: ghcr.io/grumpysdb/oscar-shareable-oscar:${DOCKER_IMAGE_TAG:-latest}
      DOCKER_NETWORK: ${DOCKER_NETWORK:-oscar-shareable_internal}
      JWT_SECRET_FILE: /run/secrets/jwt_secret
      APP_USERNAME_FILE: /run/secrets/app_username
      APP_PASSWORD_FILE: /run/secrets/app_password
      DISCORD_CLIENT_SECRET_FILE: /run/secrets/discord_client_secret
    secrets:
      - jwt_secret
      - app_username
      - app_password
      - discord_client_secret
    restart: unless-stopped
    volumes:
      - ${DOCKER_HOST_PATH:-.}/data/uploads:/app/data/uploads
      - ${DOCKER_HOST_PATH:-.}/data/profiles:/app/data/profiles
      - ${DOCKER_HOST_PATH:-.}/data/app_config:/app/data/app_config
    read_only: true
    tmpfs:
      - /tmp:size=512m
      - /var/tmp
    deploy:
      resources:
        limits:
          memory: 2g
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    depends_on:
      - nginx
      - cloudflared
      - docker-socket-proxy
    networks:
      - internal

  oscar:
    image: ghcr.io/grumpysdb/oscar-shareable-oscar:${DOCKER_IMAGE_TAG:-latest}
    profiles: [ "template" ]
    container_name: oscar-template
    restart: "no"
    ports:
      - 0.0.0.0:3030:3000
    volumes:
      - ${DOCKER_HOST_PATH:-.}/data/profiles:/config/Documents/OSCAR_Data:rw
      - ${DOCKER_HOST_PATH:-.}/data/uploads:/config/Documents/SDCARD:rw
      - ${DOCKER_HOST_PATH:-.}/data/app_config:/config/.config/OSCAR_Team:rw
    deploy:
      resources:
        limits:
          memory: 768m
    environment:
      PUID: "${PUID:-911}"
      PGID: "${PGID:-911}"
      TZ: "${TZ:-America/Chicago}"
      MAX_RES: "${MAX_RES:-2560x1440}"
      TITLE: "${TITLE:-OSCAR ${OSCAR_VERSION:-1.7.1}}"
      START_DOCKER: "${START_DOCKER:-false}"
      DISABLE_IPV6: "${DISABLE_IPV6:-true}"
      NO_DECOR: "${NO_DECOR:-true}"
      NO_GAMEPAD: "${NO_GAMEPAD:-true}"
      HARDEN_DESKTOP: "${HARDEN_DESKTOP:-true}"
      HARDEN_OPENBOX: "${HARDEN_OPENBOX:-true}"
      SELKIES_ENABLE_CURSORS: "${SELKIES_ENABLE_CURSORS:-true}"
      SELKIES_AUDIO_ENABLED: "${SELKIES_AUDIO_ENABLED:-false}"
      SELKIES_GAMEPAD_ENABLED: "${SELKIES_GAMEPAD_ENABLED:-false}"
      SELKIES_UI_SIDEBAR_SHOW_GAMEPADS: "${SELKIES_UI_SIDEBAR_SHOW_GAMEPADS:-false}"
      SELKIES_UI_SIDEBAR_SHOW_CLIPBOARD: "${SELKIES_UI_SIDEBAR_SHOW_CLIPBOARD:-false}"
      SELKIES_UI_SIDEBAR_SHOW_AUDIO_SETTINGS: "${SELKIES_UI_SIDEBAR_SHOW_AUDIO_SETTINGS:-false}"
      SELKIES_UI_SIDEBAR_SHOW_SHARING: "${SELKIES_UI_SIDEBAR_SHOW_SHARING:-false}"
      SELKIES_MICROPHONE_ENABLED: "${SELKIES_MICROPHONE_ENABLED:-false}"
      SELKIES_CLIPBOARD_IN_ENABLED: "${SELKIES_CLIPBOARD_IN_ENABLED:-false}"
      SELKIES_CLIPBOARD_OUT_ENABLED: "${SELKIES_CLIPBOARD_OUT_ENABLED:-true}"
      SELKIES_SECOND_SCREEN: "${SELKIES_SECOND_SCREEN:-false}"
      SELKIES_ENABLE_SHARING: "${SELKIES_ENABLE_SHARING:-false}"
      SELKIES_UI_SHOW_CORE_BUTTONS: "${SELKIES_UI_SHOW_CORE_BUTTONS:-false}"
      SELKIES_USE_BROWSER_CURSORS: "${SELKIES_USE_BROWSER_CURSORS:-true}"
      MAX_RESOLUTION: "${MAX_RESOLUTION:-2560x1440}"
    networks:
      - internal
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID



secrets:
  jwt_secret:
    file: ${DOCKER_HOST_PATH:-.}/secrets/jwt_secret.txt
  app_username:
    file: ${DOCKER_HOST_PATH:-.}/secrets/app_username.txt
  app_password:
    file: ${DOCKER_HOST_PATH:-.}/secrets/app_password.txt
  discord_client_secret:
    file: ${DOCKER_HOST_PATH:-.}/secrets/discord_client_secret.txt
  tunnel_token:
    file: ${DOCKER_HOST_PATH:-.}/secrets/tunnel_token.txt

networks:
  internal:
    driver: bridge
    name: oscar-shareable_internal