version: "3.7"

services:

  eturnal:
    image: ghcr.io/processone/eturnal:latest
    hostname: eturnal
    container_name: eturnal
    restart: unless-stopped
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    ports:
      - 3478:3478     # STUN/TURN non-TLS
      - 3478:3478/udp # STUN/TURN non-TLS
      - 5349:5349   # STUN/TURN TLS
      - 52000-59999:52000-59999/udp # TURN relay range
    network_mode: "host"
    env_file:
      - eturnal.env
    volumes:
      - /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/turn.fruw.org:/opt/eturnal/tls