services:
  dnf-mirror:
    build: ./mirror
    restart: unless-stopped
    environment:
      MIRROR_DOMAIN: ${MIRROR_DOMAIN}
      GPG_NAME: ${GPG_NAME}
      GPG_EMAIL: ${GPG_EMAIL}
      GPG_PASSPHRASE: ${GPG_PASSPHRASE}
      SYNC_INTERVAL_SECONDS: ${SYNC_INTERVAL_SECONDS:-21600}
      SOURCES_GIT_URL: ${SOURCES_GIT_URL}
      SOURCES_GIT_REF: ${SOURCES_GIT_REF:-main}
      SOURCES_GIT_SSH_KEY: ${SOURCES_GIT_SSH_KEY:-}
      ALMA_RELEASEVER: ${ALMA_RELEASEVER:-9}
      ALMA_BASEARCH: ${ALMA_BASEARCH:-x86_64}
      ALMA_BASELINE_REPOIDS: ${ALMA_BASELINE_REPOIDS:-baseos,appstream,extras,crb,epel}
    volumes:
      - ./mirror/config/alma-baseline.repo.d:/etc/mirror/alma-baseline.repo.d:ro
      - ./git-ssh:/run/secrets/git-ssh:ro
      - ./gpg:/var/lib/mirror-gpg
      - dnf-repo-data:/srv/dnf
      - mirror-cache:/var/cache/mirror
    # kein Port-Publish: der Container schreibt nur in das Volume, das nginx
    # ausliefert. Braucht ausgehenden Internetzugriff zu den Upstream-Repos
    # UND zum Git-Repo mit der Paketliste (SOURCES_GIT_URL), das er vor jedem
    # Sync-Lauf neu abruft.

  nginx:
    image: nginx:1.27-alpine
    restart: unless-stopped
    depends_on:
      - dnf-mirror
    ports:
      - "80:80"
      # - "443:443"   # TLS: siehe README (eigene Zertifikate mounten oder
      #                 vorgeschalteten Reverse Proxy/Load Balancer nutzen)
    volumes:
      - dnf-repo-data:/usr/share/nginx/html/dnf:ro
      - ./nginx/conf.d:/etc/nginx/conf.d:ro

volumes:
  dnf-repo-data:
  mirror-cache: