services:
  guacd:
    image: guacamole/guacd:1.6.0

  guacamole:
    image: guacamole/guacamole:1.6.0
    depends_on:
      - guacd
    environment:
      GUACD_HOSTNAME: guacd
      GUACD_PORT: "4822"
    volumes:
      - ${RDP_ACCESS_RUNTIME_DIR}/config:/etc/guacamole:ro

  certgen:
    image: alpine:3.20
    environment:
      RDP_ACCESS_CERT_NAME: ${RDP_ACCESS_CERT_NAME}
      RDP_ACCESS_CERT_SAN: ${RDP_ACCESS_CERT_SAN}
      RDP_ACCESS_HOST_UID: ${RDP_ACCESS_HOST_UID}
      RDP_ACCESS_HOST_GID: ${RDP_ACCESS_HOST_GID}
    volumes:
      - ${RDP_ACCESS_RUNTIME_DIR}/tls:/tls
    entrypoint: /bin/sh
    command:
      - -ec
      - >-
        apk add --no-cache openssl >/dev/null &&
        (test -s /tls/cert.pem && test -s /tls/key.pem &&
        openssl x509 -checkend 3600 -noout -in /tls/cert.pem) ||
        (umask 077 &&
        openssl req -x509 -newkey rsa:3072 -sha256 -nodes -days 1
        -keyout /tls/key.pem -out /tls/cert.pem
        -subj /CN=$${RDP_ACCESS_CERT_NAME}
        -addext subjectAltName=$${RDP_ACCESS_CERT_SAN} &&
        chown $${RDP_ACCESS_HOST_UID}:$${RDP_ACCESS_HOST_GID} /tls /tls/cert.pem /tls/key.pem)

  gateway:
    image: nginx:1.27-alpine
    depends_on:
      - guacamole
    ports:
      - ${RDP_ACCESS_BIND}:${RDP_ACCESS_HTTP_PORT}:8443
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ${RDP_ACCESS_RUNTIME_DIR}/tls:/etc/nginx/tls:ro