services:
  ssclash:
    build:
      context: .
    image: ${IMAGE_NAME:-mohomo-docker:local}
    container_name: ${CONTAINER_NAME:-mohomo-docker}
    restart: unless-stopped
    init: true
    environment:
      SUBSCRIPTION_URL: ${SUBSCRIPTION_URL:?set SUBSCRIPTION_URL in .env}
      SSCLASH_PASSWORD: ${SSCLASH_PASSWORD:-}
    ports:
      # Keep the plaintext Web UI behind a host-local HTTPS reverse proxy.
      - "127.0.0.1:${WEB_PORT:-9091}:9091/tcp"
      - "${PROXY_BIND:-127.0.0.1}:${PROXY_PORT:-7890}:7890/tcp"
      - "${PROXY_BIND:-127.0.0.1}:${PROXY_PORT:-7890}:7890/udp"
    volumes:
      - ssclash-data:/opt/clash
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 20s
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

volumes:
  ssclash-data: