docker-compose.yml

services:
  traefik:
    image: traefik:v3.6.8
    container_name: remote-dev-box-traefik
    hostname: remote-dev-box-traefik
    volumes:
      - "./traefik.yml:/etc/traefik/traefik.yml:ro"
      - "./dynamic:/etc/traefik/dynamic:ro"
      - "./certs:/etc/traefik/certs:ro"
    networks:
      - remote-dev-net-infra
      - remote-dev-net-user
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - DAC_OVERRIDE
    ports:
      - "80:80"
      - "443:443"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik-dash.rule=Host(`traefik.${DOMAIN_NAME}`)"
      - "traefik.http.routers.traefik-dash.entrypoints=websecure"
      - "traefik.http.routers.traefik-dash.tls=true"
      - "traefik.http.routers.traefik-dash.middlewares=testdev-auth@file"
      - "traefik.http.routers.traefik-dash.service=api@internal"
    depends_on:
      - socket-proxy
    restart: unless-stopped
    security_opt:
      - "seccomp:./admin/security/traefik.seccomp.json"
    deploy:
      resources:
        limits:
          memory: 64M
          cpus: '0.50'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  socket-proxy:
    image: tecnativa/docker-socket-proxy:v0.4.2
    container_name: remote-dev-box-proxy
    hostname: remote-dev-box-proxy
    restart: unless-stopped
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    environment:
      - CONTAINERS=1
      - NETWORKS=1
      - EVENTS=1
      - VERSION=1
      - INFO=1
      - PING=1
      - SWARM=1
      - POST=1
      - DELETE=1
      - PUT=1
      - IMAGES=1
    networks:
      - remote-dev-net-infra
    cap_drop:
      - ALL
    security_opt:
      - "seccomp:./admin/security/traefik.seccomp.json"
    deploy:
      resources:
        limits:
          memory: 64M
          cpus: '0.10'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  dnsmasq:
    image: 4km3/dnsmasq:2.90-r3
    container_name: remote-dev-box-dns
    hostname: remote-dev-box-dns
    # Address syntax: /domain/ip
    command: --log-queries --log-facility=- --no-dhcp-interface= --bind-dynamic --address=/${DOMAIN_NAME}/${HOST_IP}
    cap_add:
      - NET_ADMIN
      - NET_BIND_SERVICE
      - SETUID
      - SETGID
    cap_drop:
      - ALL
    # ports:
    #   - "5354:53/udp"
    #   - "5354:53/tcp"
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 64M
          cpus: '0.10'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    network_mode: host
    # networks:
    #   - remote-dev-net-infra
    #   - remote-dev-net-user

  dashboard:
    build: ./remote-dev-box-dashboard
    container_name: remote-dev-box-dashboard
    hostname: remote-dev-box-dashboard
    restart: unless-stopped
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./:${HOST_PROJECT_ROOT}:rshared"
    networks:
      - remote-dev-net-infra
      - remote-dev-net-user
    cap_add:
      - SYS_ADMIN
      - MKNOD
    security_opt:
      - apparmor:unconfined
    device_cgroup_rules:
      - 'b 7:* rmw'
    devices:
      - /dev/loop-control:/dev/loop-control
      - /dev/fuse:/dev/fuse
    # Note: Using host-parity paths and CAP_SYS_ADMIN + AppArmor unconfined + loop devices mapping
    # instead of full privileged: true for Least Privilege disk management.
    environment:
      - PROJECT_ROOT=${HOST_PROJECT_ROOT}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`dashboard.${DOMAIN_NAME}`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.services.dashboard.loadbalancer.server.port=3000"
    deploy:
      resources:
        limits:
          memory: 64M
          cpus: '0.10'
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  model-downloader:
    profiles: [ "llm" ]
    image: python:3.12-slim
    container_name: remote-dev-box-model-downloader
    volumes:
      - ./models:/models
    command:
      - sh
      - -lc
      - |
        set -e
        mkdir -p /models

        if [ ! -f /models/Qwen3.5-2B-Q4_K_M.gguf ]; then
          echo "Installing huggingface_hub..."
          pip install --no-cache-dir -U huggingface_hub

          echo "Downloading model..."
          python -c "from huggingface_hub import hf_hub_download; hf_hub_download(repo_id='unsloth/Qwen3.5-2B-GGUF', filename='Qwen3.5-2B-Q4_K_M.gguf', local_dir='/models', local_dir_use_symlinks=False); print('Done.')"
        else
          echo "Model already present, skipping download."
        fi
    restart: "no"

  llama:
    profiles: [ "llm" ]
    image: ghcr.io/ggml-org/llama.cpp:server
    container_name: remote-dev-box-llama
    hostname: remote-dev-box-llama
    volumes:
      - ./models:/models:ro
    command: >
      -m /models/Qwen3.5-2B-Q4_K_M.gguf --host 0.0.0.0 --port 8080 -c 4096
    restart: unless-stopped
    depends_on:
      model-downloader:
        condition: service_completed_successfully
    networks:
      - remote-dev-net-models

  app:
    profiles: [ "llm" ]
    build: ./llm_gateway
    container_name: remote-dev-box-llm-gateway
    depends_on:
      - llama
    environment:
      LLAMA_API_URL: http://llama:8080
    networks:
      - remote-dev-net-models
      - remote-dev-net-user
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.llm-gateway.rule=Host(`llm.${DOMAIN_NAME}`)"
      - "traefik.http.routers.llm-gateway.entrypoints=websecure"
      - "traefik.http.routers.llm-gateway.tls=true"
      - "traefik.http.services.llm-gateway.loadbalancer.server.port=8000"

networks:
  remote-dev-net-infra:
    external: true
  remote-dev-net-user:
    external: true
  remote-dev-net-models:
    driver: bridge