services:
  guacd:
    image: guacamole/guacd:latest
    container_name: ${GUACD_NAME}
    restart: always
    cpus: 1.0
    mem_limit: "1024m"
    mem_reservation: "256m"
    restart: unless-stopped
    networks:
      - guac_internal
      - guac_ssh

  guacamole:
    image: guacamole/guacamole:latest
    container_name: guacamole
    restart: always
    user: root
    ports:
      - 8080:8080
    cpus: 2.0
    mem_limit: "3072m"       # 3 GB
    mem_reservation: "1024m"
    environment:
      - GUACD_HOSTNAME=${GUACD_NAME}
      - MYSQL_HOSTNAME=${GUAC_DB_HOST}
      - MYSQL_PORT=${GUAC_DB_PORT}
      - MYSQL_DATABASE=${GUAC_DB_NAME}
      - MYSQL_USER=${GUAC_DB_USER}
      - MYSQL_PASSWORD=${GUAC_DB_PASS}
      - MYSQL_SSL_MODE=disabled
      - CATALINA_OPTS="-Djava.security.egd=file:/dev/./urandom -Xms1g -Xmx2g"
    ports:
      - "8080:8080"
    depends_on:
      - ${GUACD_NAME}
    #networks:
      - guac_internal
      - guac_external
    labels:
      - "traefik.enable=${GUAC_TRAEFIK_ENABLED}"
      - "traefik.http.routers.guac.rule=Host(`${GUAC_TRAEFIK_HOSTNAME}.${TRAEFIK_DNS_SUFFIX}`)"
      - "traefik.http.routers.guac.entrypoints=${GUAC_TRAEFIK_ENTRYPOINT}"
      - "traefik.http.routers.guac.tls=true"
      - "traefik.http.services.guac.loadbalancer.server.port=${GUAC_TRAEFIK_PORT}"
      - "traefik.http.routers.guac.tls.certresolver=${GUAC_TRAEFIK_RESOLVER}"
      - "traefik.docker.network=guac_external"

      # Middleware 1: Redirect
      - "traefik.http.middlewares.guac-redirect.redirectregex.regex=^https://([^/]+)/?$$"
      - "traefik.http.middlewares.guac-redirect.redirectregex.replacement=https://$${1}/guacamole/"

      # Middleware 2: Disable Buffering (Stability Fix)
      - "traefik.http.middlewares.guac-buffer.buffering.maxResponseBodyBytes=0"
      - "traefik.http.middlewares.guac-buffer.buffering.maxRequestBodyBytes=0"
      - "traefik.http.middlewares.guac-buffer.buffering.memRequestBodyBytes=0"
      - "traefik.http.middlewares.guac-buffer.buffering.memResponseBodyBytes=0"
      - "traefik.http.middlewares.guac-buffer.buffering.retryExpression=IsNetworkError() && Attempts() <= 2"

      # Apply Both
      - "traefik.http.routers.guac.middlewares=guac-redirect,guac-buffer"
networks:
  guac_internal:
    internal: true
  guac_external:
    driver: bridge
  guac_ssh:
    external: true