services:
  mihomo:
    build:
      context: .
    image: ${IMAGE_NAME:-mohomo-docker:local}
    container_name: ${CONTAINER_NAME:-mohomo-docker}
    restart: unless-stopped
    init: true
    read_only: true
    ports:
      - "${PROXY_BIND:-127.0.0.1}:${PROXY_PORT:-7890}:7890/tcp"
      - "${CONTROLLER_BIND:-127.0.0.1}:${CONTROLLER_PORT:-9090}:9090/tcp"
    secrets:
      - source: subscription
        target: subscription
        mode: 0444
    volumes:
      - mihomo-data:/data
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=16m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 20s
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

secrets:
  subscription:
    file: ${SUBSCRIPTION_FILE:-./subscription.url}

volumes:
  mihomo-data: