# pangolin 数据/分发面(方案 C)。
# 与现网 marzban/jiu/billing/blog 并存:edge 反代到它们,其余容器不动。
# 镜像固定版本(EC2 实测:nginx 1.27 / sing-box 1.13.12 / xray 26.3.27)。
# project 名由命令行 `-p pangolin` 指定(兼容宿主 docker-compose 版本)。

services:
  # 分发层:接管 80/443,移植现网全部路由(host 网络才能绑端口并回连 127.0.0.1 后端)
  edge:
    image: nginx:1.27-alpine
    container_name: pangolin-edge
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./edge/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./edge/stream.conf:/etc/nginx/stream.conf:ro
      - ./edge/conf.d:/etc/nginx/conf.d:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro     # 证书(只读)
      - /opt/jiu:/opt/jiu:ro                     # jiu 静态(images/web/marketing)
      - /var/www/pay:/var/www/pay:ro             # 收款页静态
    healthcheck:
      test: ["CMD", "nginx", "-t"]
      interval: 1m
      timeout: 10s
      retries: 3

  # Hysteria2 加速线(UDP 443)
  singbox:
    image: ghcr.io/sagernet/sing-box:v1.13.12
    container_name: pangolin-singbox
    restart: unless-stopped
    network_mode: host
    volumes:
      - ./singbox/config.json:/etc/sing-box/config.json:ro
      - ./secrets/hy2:/etc/sing-box/cert:ro
    command: ["run", "-c", "/etc/sing-box/config.json"]

  # 证书续期(DNS-01 / Cloudflare)—— 按需运行:`docker compose run --rm certbot renew`
  # 由宿主 cron 每日调用,renew 后宿主再 `docker exec pangolin-edge nginx -s reload`。
  certbot:
    image: certbot/dns-cloudflare:latest
    container_name: pangolin-certbot
    profiles: ["certbot"]
    volumes:
      - /etc/letsencrypt:/etc/letsencrypt
      - ./secrets/cloudflare.ini:/etc/cloudflare.ini:ro
    entrypoint: ["certbot"]

  # 新节点用的 REALITY —— 本台不启用(REALITY 仍由 Marzban 提供)
  xray:
    image: ghcr.io/xtls/xray-core:26.3.27
    container_name: pangolin-xray
    profiles: ["newnode"]
    restart: unless-stopped
    ports:
      - "127.0.0.1:11443:11443"
    volumes:
      - ./xray/config.json:/etc/xray/config.json:ro
    command: ["run", "-c", "/etc/xray/config.json"]