# Optional: route Soulseek traffic through a VPN container (gluetun).
#
# This is a reference, not a drop-in file. Most people can ignore it and use
# the plain `ports:` mapping shown in the README. Use this pattern only if you
# want alembic's outbound traffic to leave through a VPN.
#
# The idea: instead of giving alembic its own network, you attach it to a
# gluetun container's network with `network_mode: "service:gluetun"`. All of
# alembic's traffic then exits through the VPN gluetun maintains.
#
# When you do this, three things change compared to the README example:
#   1. alembic no longer publishes its own port. Publish 8420 on the gluetun
#      service instead (add `- 8420:8420` to gluetun's `ports:`).
#   2. gluetun's firewall must allow alembic to reach your other containers
#      (Navidrome, etc). Add your Docker bridge subnet to gluetun's
#      FIREWALL_OUTBOUND_SUBNETS, for example:
#        FIREWALL_OUTBOUND_SUBNETS=192.168.0.0/24,172.18.0.0/16
#      Find your subnet with: docker network inspect <your-compose-project>_default
#   3. If you use a reverse proxy, point it at gluetun's host/port, not
#      alembic's. Once alembic shares gluetun's network it has no container
#      hostname of its own.

  alembic:
    image: alembic:latest
    container_name: alembic
    network_mode: "service:gluetun"
    depends_on:
      gluetun:
        condition: service_healthy
    env_file:
      # Your OIDC settings (POCKETID_ISSUER, POCKETID_CLIENT_ID,
      # POCKETID_CLIENT_SECRET) and any other env vars.
      - /path/to/alembic-config/alembic.env
    volumes:
      - /path/to/your/music:/data/music:rw
      - /path/to/alembic-config:/config:rw
    secrets:
      - alembic_master_key
    restart: unless-stopped

# Add alongside the existing top-level `secrets:` block (create one if this
# compose file doesn't have one yet).
#
# Keep master.key OUTSIDE the config volume. The key decrypts every stored
# credential, and the encrypted database lives in the config volume, so if the
# key sits in there too then a single leaked backup exposes both halves and the
# encryption buys you nothing. Put it in its own directory that your config
# backup does not include:
# secrets:
#   alembic_master_key:
#     file: /path/to/alembic-secrets/master.key