# Production overlay — adds Watchtower auto-update service and VideoStore mounts
#
# Usage:
#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
#
# Watchtower checks the registry on schedule and auto-updates containers
# that have the com.centurylinklabs.watchtower.enable=true label.
#
# VideoStore strategy:
#   - Backend is privileged with pid:host so it can use nsenter to mount
#     physical drives in the HOST mount namespace (replacing autofs).
#   - All containers use slave propagation: host mounts flow in, but
#     container lifecycle never unmounts drives on the host.

services:
  backend:
    privileged: true
    pid: "host"
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - type: bind
        source: /videostore
        target: /videostore
        bind:
          propagation: slave
  engine:
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - type: bind
        source: /videostore
        target: /videostore
        bind:
          propagation: slave
  connector:
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - type: bind
        source: /videostore
        target: /videostore
        bind:
          propagation: slave
  playback:
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    volumes:
      - type: bind
        source: /videostore
        target: /videostore
        bind:
          propagation: slave
  viewer:
    privileged: true
    environment:
      - DISPLAY=:1
    volumes:
      - "/tmp/.X11-unix:/tmp/.X11-unix:rw"
    devices:
      - /dev/dri:/dev/dri
      - /dev/tty1:/dev/tty1
      - /dev/tty7:/dev/tty7
      - /dev/input:/dev/input
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  watchtower:
    image: containrrr/watchtower:latest
    restart: always
    network_mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /root/.docker/config.json:/config.json:ro
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_LABEL_ENABLE=true
      - WATCHTOWER_SCHEDULE=${WATCHTOWER_SCHEDULE:-0 0 2 * * *}
      - DOCKER_API_VERSION=1.44
    command: --label-enable
