# Internet Use Control — Control Service (own image, own container, own port).
# Deploy on .13:  cd /home/sam/paseo/projects/internet_use_control && docker compose up -d --build
# The service is the single source of truth (SYSTEM_MAP.md). Only it publishes config.
#
# MQTT is transport, not storage: the service publishes retained config to the
# shared Mosquitto on `.13:1883` and writes what devices report into SQLite.

name: webrestrict

services:
  control:
    build:
      context: .
      args:
        VERSION: "0.4.0-phase6"
    image: webrestrict/control:0.4.0-phase6
    container_name: webrestrict-control
    restart: unless-stopped
    env_file:
      - environment.d/control-service.env
    ports:
      - "8791:8791"
    # The broker is the Mosquitto container on the host. No host IP is baked
    # in: the gateway is resolved at start, so CONTROL_MQTT_BROKER can stay
    # "tcp://host.docker.internal:1883".
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - webrestrict-data:/data
      # The lab CA for broker TLS verification. Read-only and optional: the
      # file is absent until the TLS listener exists.
      - ./deploy/mosquitto/tls:/etc/webrestrict/tls:ro
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8791/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  webrestrict-data: