# Example Swarm stack for the package-updater master (phase 2: inventory and manual updates).
# Deploy on the manager: docker stack deploy -c master.stack.yml package-updater-master
#
# Before deploying:
#   1. In Postgres: CREATE USER package_updater ...; CREATE DATABASE package_updater OWNER package_updater;
#   2. In Authentik: create an OAuth2/OpenID provider + application with redirect URI
#      https://updater.example.com/auth/callback, and a group "updater-admins".
#   3. docker secret create pu_oidc_client_secret - ; docker secret create pu_database_url -
services:
  master:
    image: gitea.shcizo.se/shcizo/package-updater:latest
    entrypoint: ["/bin/sh", "-c", "DATABASE_URL=$$(cat /run/secrets/pu_database_url) OIDC_CLIENT_SECRET=$$(cat /run/secrets/pu_oidc_client_secret) exec /usr/local/bin/updater-master"]
    environment:
      PUBLIC_URL: https://updater.example.com
      AGENT_URL: wss://10.0.0.5:8090/agent
      OIDC_ISSUER: https://auth.example.com/application/o/package-updater/
      OIDC_CLIENT_ID: package-updater
      ALLOWED_GROUP: updater-admins
    secrets:
      - pu_database_url
      - pu_oidc_client_secret
    ports:
      # Agents connect here directly over the internal network, not via the proxy.
      - target: 8090
        published: 8090
        mode: host
    networks:
      - proxy
    deploy:
      placement:
        constraints: [node.role == manager]

secrets:
  pu_database_url:
    external: true
  pu_oidc_client_secret:
    external: true

networks:
  proxy:
    external: true