# Optional browser-accessible Switch runtime. Combine with compose.yml only after setting all
# SWITCH_* variables. The game library is always mounted read-only and no Docker socket is exposed.
services:
  ludarium:
    environment:
      LUDARIUM_SWITCH_PLAYER_URL: ${SWITCH_PLAYER_URL:?set the trusted-LAN Eden URL}
      LUDARIUM_SWITCH_KEYS_ROOT: /app/switch-keys
      LUDARIUM_SWITCH_PROXY_URL: https://eden:3001/
      LUDARIUM_SWITCH_PROXY_USERNAME: ${SWITCH_REMOTE_USER:?set the Eden trusted-LAN username}
      LUDARIUM_SWITCH_PROXY_PASSWORD: ${SWITCH_REMOTE_PASSWORD:?set the Eden trusted-LAN password}
      LUDARIUM_SWITCH_PROXY_CERT_SHA256: ${SWITCH_PROXY_CERT_SHA256:?pin the Eden TLS certificate SHA-256}
      LUDARIUM_SWITCH_EMBED_PORT: ${SWITCH_EMBED_PORT:-1231}
      LUDARIUM_SWITCH_EMBED_ORIGIN: ${SWITCH_EMBED_ORIGIN:-}
      LUDARIUM_SWITCH_CONTROL_URL: http://eden:8765/
      LUDARIUM_SWITCH_CONTROL_TOKEN: ${SWITCH_CONTROL_TOKEN:?set the internal Eden control token}
      LUDARIUM_SWITCH_CATALOG_PREFIX: ${SWITCH_CATALOG_PREFIX:-roms/switch}
    ports:
      - ${SWITCH_EMBED_PORT:-1231}:8734
    volumes:
      - ${SWITCH_DATA_ROOT:?set isolated app-owned Switch data}/config/.local/share/eden/keys:/app/switch-keys:rw
    depends_on:
      eden:
        condition: service_healthy

  eden:
    container_name: ${SWITCH_CONTAINER_NAME:-Ludarium-Switch}
    image: ${SWITCH_IMAGE:-ludarium/eden-controller:0.4.9-rc.1}
    labels:
      net.unraid.docker.webui: "${SWITCH_PUBLIC_URL:-http://[IP]:[PORT:1262]/}"
      net.unraid.docker.icon: "/boot/config/plugins/dockerMan/images/Ludarium-icon.svg"
      net.unraid.docker.managed: "dockerman"
      net.unraid.docker.shell: ""
    environment:
      PUID: ${PUID:-1654}
      PGID: ${PGID:-1654}
      TZ: ${TZ:-Europe/Brussels}
      PIXELFLUX_WAYLAND: "true"
      DRINODE: ${SWITCH_DRI_NODE:-/dev/dri/renderD128}
      DRI_NODE: ${SWITCH_DRI_NODE:-/dev/dri/renderD128}
      START_DOCKER: "false"
      DISABLE_IPV6: "true"
      CUSTOM_USER: ${SWITCH_REMOTE_USER:?set the Eden trusted-LAN username}
      PASSWORD: ${SWITCH_REMOTE_PASSWORD:?set the Eden trusted-LAN password}
      LUDARIUM_EDEN_CONTROL_TOKEN: ${SWITCH_CONTROL_TOKEN:?set the internal Eden control token}
      # App-owned save directory the Game Data Vault captures and restores. Override only when a
      # different Eden build stores its saves elsewhere.
      LUDARIUM_EDEN_SAVE_ROOT: ${SWITCH_SAVE_ROOT:-/config/.local/share/eden}
      TITLE: Ludarium Switch
      FILE_MANAGER_PATH: /games
      SUBFOLDER: /switch-player/
      HARDEN_DESKTOP: "true"
      HARDEN_OPENBOX: "true"
      SELKIES_ENABLE_SHARING: "false|locked"
      SELKIES_ENABLE_COLLAB: "false|locked"
      SELKIES_ENABLE_SHARED: "false|locked"
      SELKIES_FILE_TRANSFERS: "false|locked"
      SELKIES_COMMAND_ENABLED: "false|locked"
      SELKIES_CLIPBOARD_ENABLED: "false|locked"
      SELKIES_CLIPBOARD_IN_ENABLED: "false|locked"
      SELKIES_CLIPBOARD_OUT_ENABLED: "false|locked"
      SELKIES_MICROPHONE_ENABLED: "false|locked"
      SELKIES_UI_SIDEBAR_SHOW_CLIPBOARD: "false|locked"
      SELKIES_UI_SIDEBAR_SHOW_FILES: "false|locked"
      SELKIES_UI_SIDEBAR_SHOW_APPS: "false|locked"
    ports:
      - ${SWITCH_REMOTE_PORT:-1262}:3001
    devices:
      - /dev/dri:/dev/dri
    shm_size: 1gb
    volumes:
      - ${SWITCH_DATA_ROOT}/config:/config:rw
      - ${SWITCH_LIBRARY:?set the Switch source library}:/games:ro
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test:
        - CMD
        - python3
        - -c
        - "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8765/health', timeout=3).read()"
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s
    restart: unless-stopped