# sing-box HTTP forward proxy on us4.wsvc.info, published through Traefik :6443.
#
# TLS terminates in Traefik (entrypoint `proxyin`); sing-box only speaks plain
# HTTP-proxy on the private `proxy` Docker network, so it publishes NO host port.
# The credential lives in the server-side ./config.json (mode 0600) and is never
# committed here.
#
# Repo-owned copy of /opt/sing-box/compose.yml (static mechanism, not yet wired
# to compose-deploy). Change record: Plane VPS-99. Health: runbooks/proxy-health.md.
services:
  sing-box:
    image: ghcr.io/sagernet/sing-box:v1.14.2@sha256:afbffd294c5eb3519cc7b4587299ef189bb0a2ca2f667cb6301fdb6b9bce9558
    container_name: sing-box
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    command:
      - run
      - -c
      - /etc/sing-box/config.json
    volumes:
      - ./config.json:/etc/sing-box/config.json:ro
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"

      # TCP router: TLS terminates here, decrypted bytes go to sing-box.
      - "traefik.tcp.routers.singbox-proxy.rule=HostSNI(`us4.wsvc.info`)"
      - "traefik.tcp.routers.singbox-proxy.entrypoints=proxyin"
      - "traefik.tcp.routers.singbox-proxy.tls=true"
      - "traefik.tcp.routers.singbox-proxy.tls.certresolver=letsencrypt"

      # TCP service: in-container HTTP proxy port.
      - "traefik.tcp.routers.singbox-proxy.service=singbox-proxy"
      - "traefik.tcp.services.singbox-proxy.loadbalancer.server.port=8080"

networks:
  proxy:
    name: proxy
    external: true