services:
  redis:
    image: redis:8.8.1-alpine
    volumes:
      - redis_data:/data

  trawl:
    image: ghcr.io/germondai/trawl:latest
    ports:
      # API + FlareSolverr-compatible /v1
      - "${PORT:-8191}:8191"
      # MITM forward proxy (:8192) — only used when MITM_PROXY_ENABLED=true.
      # The CA cert is served from :8191/proxy-ca.crt and must be installed
      # in each client's trust store (system keychain, Java cacerts, etc.).
      - "${MITM_PROXY_PORT:-8192}:${MITM_PROXY_PORT:-8192}"
    shm_size: 1gb
    environment:
      REDIS_URL: redis://redis:6379
      BROWSER_POOL_SIZE: ${BROWSER_POOL_SIZE:-1}
      PROXY_URL: ${PROXY_URL:-}
      PROXY_LIST_FILE: ${PROXY_LIST_FILE:-}
      RESIDENTIAL_PROXY_URL: ${RESIDENTIAL_PROXY_URL:-}
      RESIDENTIAL_PROXY_LIST_FILE: ${RESIDENTIAL_PROXY_LIST_FILE:-}
      # MITM proxy (off by default — opt in via .env)
      MITM_PROXY_ENABLED: ${MITM_PROXY_ENABLED:-false}
      MITM_PROXY_HOST: ${MITM_PROXY_HOST:-0.0.0.0}
      MITM_PROXY_PORT: ${MITM_PROXY_PORT:-8192}
      MITM_PROXY_CA_DIR: ${MITM_PROXY_CA_DIR:-/data/proxy-ca}
      MITM_PROXY_MAX_TIER: ${MITM_PROXY_MAX_TIER:-4}
      MITM_PROXY_DEBUG: ${MITM_PROXY_DEBUG:-false}
    volumes:
      # Persist the proxy's CA so clients don't need to re-install on every restart.
      - trawl_proxy_ca:${MITM_PROXY_CA_DIR:-/data/proxy-ca}
    depends_on:
      - redis
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8191/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 90s

volumes:
  redis_data:
  trawl_proxy_ca: