services:
  cert-gen:
    image: alpine:latest
    volumes:
      - tls-certs:/etc/nginx/ssl
    command: |
      sh -c '
        apk add --no-cache openssl &&
        openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
          -keyout /etc/nginx/ssl/key.pem \
          -out /etc/nginx/ssl/cert.pem \
          -subj "/CN=nginx" &&
        chmod 644 /etc/nginx/ssl/cert.pem /etc/nginx/ssl/key.pem
      '

  nginx:
    image: nginx:latest
    depends_on:
      cert-gen:
        condition: service_completed_successfully
      xray-server:
        condition: service_started
    volumes:
      - ./config/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - tls-certs:/etc/nginx/ssl:ro

  xray-server:
    image: ghcr.io/xtls/xray-core:latest
    volumes:
      - ./config/server.json:/etc/xray/config.json:ro
    command: run -c /etc/xray/config.json

  xray-client:
    image: ghcr.io/xtls/xray-core:latest
    depends_on:
      - nginx
    volumes:
      - ./config/client.json:/etc/xray/config.json:ro
    ports:
      - 127.0.0.1:4343:4343
    command: run -c /etc/xray/config.json

volumes:
  tls-certs: