services:
  caddy:
    image: caddy:latest
    container_name: caddy
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
      - 443:443/udp
    volumes:
      - ./caddy:/etc/caddy
      - ./data/caddy-data:/data
      - ./data/caddy-config:/config
    extra_hosts:
      - host.docker.internal:host-gateway

  portainer-agent-tailscale:
    image: tailscale/tailscale:latest
    container_name: portainer-agent-tailscale
    hostname: tle-knot-portainer-agent
    environment:
      - TS_AUTHKEY=${TAILSCALE_AUTHKEY:?error}
      - TS_EXTRA_ARGS=--advertise-tags=tag:container
      - TS_SERVE_CONFIG=/config/portainer-agent.json
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=false
      - TS_ENABLE_HEALTH_CHECK=true
    healthcheck:
      test: ['CMD', 'wget', '--spider', '-q', 'http://127.0.0.1:9002/healthz']
      interval: 10s
      timeout: 3s
    volumes:
      - ./data/tailscale-portainer-agent:/var/lib/tailscale
      - ./tailscale/portainer-agent:/config
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - net_admin
      - sys_module
    restart: unless-stopped

  portainer-agent:
    image: portainer/agent:lts
    container_name: portainer-agent
    restart: always
    environment:
      - EDGE=1
      - EDGE_INSECURE_POLL=1
      - EDGE_ID=${PORTAINER_AGENT_EDGE_ID:?error}
      - EDGE_KEY=${PORTAINER_AGENT_EDGE_KEY:?error}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes:/var/lib/docker/volumes
      - /:/host
      - ./data/portainer-agent:/data
    network_mode: service:portainer-agent-tailscale
    depends_on:
      portainer-agent-tailscale:
        condition: service_healthy