# Run the Nexus Telemetry Fleet server in a container.
#
#   1. Set NF_STREAM_SAN in the environment to the hostname or IP collectors will dial
#      (it is baked into the stream certificate on FIRST RUN only).
#   2. docker compose up -d
#   3. Create the first user to require dashboard sign-in:
#        docker compose exec nf-server nf-server create-operator \
#            --username admin --role owner
#
# This file is the tyre-kicking path: same box, or a network you trust. The
# dashboard (3000) has built-in operator auth but is plain HTTP here. For
# production, a public name, a publicly trusted certificate, automatic
# renewal: start from docker-compose.production.yml instead.
services:
  nf-server:
    # Pulls the published server image (pushed by every release, :latest =
    # the current release). To build from this tree instead, swap in:
    #   build: { context: ., target: server }
    image: registry.nexustelemetry.com/nf-server:latest
    restart: unless-stopped
    ports:
      - "3000:3000"   # dashboard
      - "9443:9443"   # collector mTLS stream
    environment:
      # Required: the hostname or IP collectors will dial. Comes from the
      # environment, and compose refuses to start without it:
      #   NF_STREAM_SAN=fleet.example.com docker compose up -d
      NF_STREAM_SAN: "${NF_STREAM_SAN:?required, see the comment above}"
      # NF_INITIAL_ADMIN_PASSWORD: "change-me"  # seed an admin on first run
      # NF_LOG_FORMAT: "pretty"           # json is the default
    volumes:
      - nf-data:/var/lib/nexus-fleet
    # HEALTHCHECK is defined in the image (GET /health).
    stop_grace_period: 20s

volumes:
  nf-data: