# koopa-nym — nym-node (nym.com mixnet / NymVPN network)
# Live host tree: ~/koopa-nym/  (copy this directory there)
#
# Host ports chosen to avoid Caddy 9000/9001 and Tor ORPort 8080.
services:
  nym:
    build:
      context: .
      dockerfile: Containerfile
    image: localhost/koopa-nym:latest
    container_name: koopa-nym
    restart: unless-stopped
    # Non-root (image USER nym = 1000). keep-id → host ./data owned by hernani works.
    user: "1000:1000"
    userns_mode: keep-id
    env_file:
      - .env
    environment:
      NYM_HOME: /var/lib/nym
      NYMNODE_ID: ${NYMNODE_ID:-koopa-nym}
      NYMNODE_MODE: ${NYMNODE_MODE:-mixnode}
      NYMNODE_PUBLIC_IPS: ${NYMNODE_PUBLIC_IPS:-}
      NYMNODE_LOCATION: ${NYMNODE_LOCATION:-}
      NYMNODE_HOSTNAME: ${NYMNODE_HOSTNAME:-}
      NYMNODE_WG_ENABLED: ${NYMNODE_WG_ENABLED:-false}
      NYMNODE_ACCEPT_OPERATOR_TERMS: ${NYMNODE_ACCEPT_OPERATOR_TERMS:-true}
      # IPv4 binds: rootless podman port-proxy is reliable with 0.0.0.0
      # ([::] can leave verloc without a host IPv4 listener → WAN "connection refused")
      NYMNODE_HTTP_BIND_ADDRESS: ${NYMNODE_HTTP_BIND_ADDRESS:-0.0.0.0:8080}
      NYMNODE_MIXNET_BIND_ADDRESS: ${NYMNODE_MIXNET_BIND_ADDRESS:-0.0.0.0:1789}
      NYMNODE_VERLOC_BIND_ADDRESS: ${NYMNODE_VERLOC_BIND_ADDRESS:-0.0.0.0:1790}
      NYMNODE_ENTRY_BIND_ADDRESS: ${NYMNODE_ENTRY_BIND_ADDRESS:-0.0.0.0:9000}
      NYMNODE_EXTRA_ARGS: ${NYMNODE_EXTRA_ARGS:-}
    volumes:
      # identity + config.toml (bond keys live here — back up)
      - ./data:/var/lib/nym
    ports:
      # Host publish must be recreated if ports change (podman start ≠ re-map).
      - "0.0.0.0:9080:8080/tcp"     # HTTP API / swagger (local/LAN)
      - "0.0.0.0:1789:1789/tcp"     # mixnet
      - "0.0.0.0:1789:1789/udp"
      - "0.0.0.0:1790:1790/tcp"     # verloc (was missing/unreliable with bare "1790:1790")
      # gateway / WG — uncomment when mode needs them:
      # - "0.0.0.0:19000:9000/tcp"  # entry client websocket
      # - "0.0.0.0:51822:51822/udp" # WireGuard
    labels:
      org.hacktivism.service: nym
      org.hacktivism.container: koopa-nym
      org.hacktivism.managed_by: koopa-admin
      org.hacktivism.network: nym.com
      org.hacktivism.host_http_port: "9080"