app:
  id: nostr-vpn-web
  name: Nostr VPN Control Panel
  version: 1.0.0
  upstream:
    kind: github
    repo: mmalmi/nostr-vpn
  description: |
    Web control panel for the nostr-vpn paid-exit seller (apps/nostr-vpn).
    Talks to the daemon only through the shared /data volume (state-file
    status + shelling out to the nvpn CLI) -- no network link between the
    two containers, mirroring upstream's own umbrel/docker-compose.yml
    exactly (read directly, not assumed). Same image as apps/nostr-vpn,
    different entrypoint args.
  category: money

  container:
    build:
      context: /opt/archipelago/docker/nostr-vpn
      dockerfile: Dockerfile
      tag: localhost/nostr-vpn:local
    entrypoint: ["/usr/local/bin/archy-nvpn-entrypoint.sh"]
    custom_args:
      - /usr/local/bin/nvpn-web
      - --listen
      - 0.0.0.0:38080
      - --behind-trusted-proxy
      - --config
      - /data/config/nvpn/config.toml

  dependencies:
    - app_id: nostr-vpn

  resources:
    memory_limit: 128Mi

  security:
    capabilities: []
    readonly_root: false
    no_new_privileges: true
    network_policy: bridge

  ports:
    - host: 38080
      container: 38080
      protocol: tcp
      bind: 127.0.0.1
      auth: gated

  volumes:
    # Same volume as apps/nostr-vpn, read-write: the panel's wallet/seller
    # actions (wallet send, paid-exit run) shell out to the nvpn CLI
    # against this same config.toml and data dir, per
    # NVPN_EXTERNAL_DAEMON/NVPN_DAEMON_STATUS_MODE below.
    - type: bind
      source: /var/lib/archipelago/nostr-vpn
      target: /data
      options: [rw]

  environment:
    - NVPN_CLI_PATH=/usr/local/bin/nvpn
    - NVPN_DAEMON_STATUS_MODE=state-file
    - NVPN_EXTERNAL_DAEMON=true

  health_check:
    type: http
    endpoint: http://127.0.0.1:38080
    path: /
    interval: 30s
    timeout: 5s
    retries: 3

  interfaces:
    main:
      name: Control Panel
      description: nostr-vpn paid-exit status, wallet, and seller settings
      type: ui
      port: 38080
      protocol: http
      path: /

  metadata:
    category: money
    tier: optional
    author: mmalmi
    repo: https://github.com/mmalmi/nostr-vpn
    features:
      - Paid-exit seller status, wallet, and offer controls
      - Shares state with apps/nostr-vpn via one data volume, no RPC link