docker-compose.yml

# Sub2Port — one-command deploy: `docker compose up -d`
#
# Ports:
#   27000       Web UI / API
#   27001-27020 proxy mapping ports (20 ports; each mapping binds one)
#
# The published range must match `port_range` in config.yaml — the app allocates
# mapping ports from that range, and anything it hands out that isn't published
# here is unreachable from the host. Grow them together; a test in
# internal/config fails if they drift. Bridge mode starts one docker-proxy per
# published port, so a wide range noticeably slows startup — hence only 20.
#
# Published on all interfaces so the LAN can reach the Web UI and proxy ports.
# Note: the Web UI (27000) is protected by the login key, but a proxy port
# (27001-27020) is only protected if you set a username/password on that mapping —
# otherwise anyone on the LAN can use it. To restrict to this host only, prefix
# both mappings with 127.0.0.1.
services:
  sub2port:
    build: .
    image: sub2port:latest
    container_name: sub2port
    restart: unless-stopped
    ports:
      - "27000:27000"
      - "27001-27020:27001-27020"
    volumes:
      # Single data volume: config.yaml (source of truth) + nodes.json cache live
      # here. On first run the app writes a config.yaml template into ./data;
      # edit ./data/config.yaml to set auth_key, then restart.
      - ./data:/data
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:27000/api/health"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5s

# Uses a bridge network, so pin its subnet instead of letting Docker pick. Left
# to itself Docker hands out a /20, and once the 172.16-172.31 pools are used up
# it starts carving those /20s out of 192.168.0.0/16 — on a host whose LAN is in
# 192.168.x that swallows real addresses and blackholes their traffic. Change the
# subnet if it collides.
networks:
  default:
    ipam:
      config:
        - subnet: 10.201.27.0/24