docker-compose.yml

services:
  mysql:
    image: mysql:8.4
    container_name: noc-streaming-mysql
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-rootpass}
      MYSQL_DATABASE: ${MYSQL_DATABASE:-noc_streaming}
      MYSQL_USER: ${MYSQL_USER:-noc_user}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-noc_pass}
    ports:
      - "${MYSQL_PORT:-3306}:3306"
    dns:
      - "${DNS_SERVER_1:-8.8.8.8}"
      - "${DNS_SERVER_2:-1.1.1.1}"
    volumes:
      - mysql_data:/var/lib/mysql
    healthcheck:
      test:
        [
          "CMD",
          "mysqladmin",
          "ping",
          "-h",
          "localhost",
          "-uroot",
          "-p${MYSQL_ROOT_PASSWORD:-rootpass}"
        ]
      interval: 10s
      timeout: 5s
      retries: 12

  nocstream:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: noc-streaming-nocstream
    restart: unless-stopped
    shm_size: "4gb"
    depends_on:
      mysql:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: "3000"
      TZ: "${TZ:-Asia/Tokyo}"
      OFFLINE: "${OFFLINE:-false}"
      HSTS_ENABLED: "${HSTS_ENABLED:-true}"
      HSTS_MAX_AGE: "${HSTS_MAX_AGE:-31536000}"
      HSTS_INCLUDE_SUBDOMAINS: "${HSTS_INCLUDE_SUBDOMAINS:-true}"
      CSP_UPGRADE_INSECURE_REQUESTS: "${CSP_UPGRADE_INSECURE_REQUESTS:-false}"
      JWT_SECRET: "${JWT_SECRET:?JWT_SECRET is required}"
      SECRET_ENCRYPTION_KEY: "${SECRET_ENCRYPTION_KEY:?SECRET_ENCRYPTION_KEY is required}"
      AUTH_TOKEN_TTL_SECONDS: "${AUTH_TOKEN_TTL_SECONDS:-3600}"
      COOKIE_SECURE: "${COOKIE_SECURE:-false}"
      WORKER_MODE: "real"
      WORKER_MONITOR_INTERVAL_MS: "5000"
      ADMIN_USERNAME: "${ADMIN_USERNAME:-admin}"
      ADMIN_PASSWORD: "${ADMIN_PASSWORD:-password}"
      ADMIN_FORCE_RESET_PASSWORD: "${ADMIN_FORCE_RESET_PASSWORD:-true}"
      LDAP_BOOTSTRAP_ENABLED: "${LDAP_BOOTSTRAP_ENABLED:-false}"
      LDAP_SERVER_URL: "${LDAP_SERVER_URL:-ldaps://ldap.example.local:636}"
      LDAP_BIND_DN: "${LDAP_BIND_DN:-cn=admin,dc=example,dc=local}"
      LDAP_BIND_PASSWORD: "${LDAP_BIND_PASSWORD:-changeme}"
      LDAP_BASE_DN: "${LDAP_BASE_DN:-dc=example,dc=local}"
      LDAP_USER_FILTER: "${LDAP_USER_FILTER:-(uid={username})}"
      LDAP_GROUP_DN: "${LDAP_GROUP_DN:-cn=noc-admins,ou=groups,dc=example,dc=local}"
      WORKER_VNC_ENABLED: "${WORKER_VNC_ENABLED:-true}"
      VNC_PUBLIC_HOST: "${VNC_PUBLIC_HOST:-localhost}"
      VNC_BASE_PORT: "${VNC_BASE_PORT:-15900}"
      VNC_PORT_SPAN: "${VNC_PORT_SPAN:-50}"
      NOVNC_ENABLED: "${NOVNC_ENABLED:-true}"
      NOVNC_PUBLIC_BASE_URL: "${NOVNC_PUBLIC_BASE_URL:-http://localhost:6080}"
      DATABASE_URL: "${DATABASE_URL:-mysql://${MYSQL_USER:-noc_user}:${MYSQL_PASSWORD:-noc_pass}@mysql:3306/${MYSQL_DATABASE:-noc_streaming}}"
    ports:
      - "${NOCSTREAM_PORT:-3000}:3000"
      - "${VNC_HOST_PORT_RANGE:-15900-15949}:15900-15949"
    dns:
      - "${DNS_SERVER_1:-8.8.8.8}"
      - "${DNS_SERVER_2:-1.1.1.1}"
    extra_hosts:
      - "host.docker.internal:host-gateway"

  novnc:
    image: theasp/novnc:latest
    container_name: noc-streaming-novnc
    restart: unless-stopped
    depends_on:
      nocstream:
        condition: service_started
    environment:
      RUN_XTERM: "no"
      RUN_FLUXBOX: "no"
      DISPLAY_WIDTH: "1920"
      DISPLAY_HEIGHT: "1080"
      VNC_BASE_PORT: "${VNC_BASE_PORT:-15900}"
      VNC_PORT_SPAN: "${VNC_PORT_SPAN:-50}"
      VNC_TOKEN_MAX_ID: "${VNC_TOKEN_MAX_ID:-1000}"
    ports:
      - "${NOVNC_PORT:-6080}:6080"
    dns:
      - "${DNS_SERVER_1:-8.8.8.8}"
      - "${DNS_SERVER_2:-1.1.1.1}"
    command: >
      bash -lc '
        set -eu;
        TOKENS=/tmp/tokens.cfg;
        : > "$$TOKENS";
        i=0;
        while [ "$$i" -lt "$$VNC_TOKEN_MAX_ID" ]; do
          port=$$((VNC_BASE_PORT + (i % VNC_PORT_SPAN)));
          echo "job-$$i: nocstream:$$port" >> "$$TOKENS";
          i=$$((i + 1));
        done;
        exec websockify --web /usr/share/novnc 6080 --token-plugin TokenFile --token-source "$$TOKENS"
      '

volumes:
  mysql_data: