shahriarraka/warp-proxy-stack:latest

networks:
  # Internal-ish pool network: workers live here and are only reachable by
  # the gateway (their SOCKS5 ports are never published to the host).
  warp_pool_net:
    driver: bridge

services:
  gateway:
    image: shahriarraka/warp-gateway:latest 
    container_name: warp-gateway
    restart: unless-stopped
    networks:
      - warp_pool_net
    ports:
      # Loopback-only: the gateway is meant to be reached by clients running
      # on the same host (e.g. the crawler process that started this stack),
      # not published to the VM's public interface. Set PROXY_USER/PROXY_PASS
      # below and change these to "0.0.0.0:<port>:<port>" only if you actually
      # need remote access.
      - "127.0.0.1:1080:1080"   # SOCKS5 for clients
      - "127.0.0.1:8080:8080"   # HTTP/HTTPS (CONNECT) for clients
      - "127.0.0.1:9090:9090"   # status/rotate control API - has no auth of its own
    environment:
      # Must be the fully-qualified image the gateway can `docker run`. It shells
      # out to `docker run <this>`, which pulls from Docker Hub if absent - so it
      # needs the namespace (shahriarraka/...), not the bare `warp-worker:latest`
      # (that resolves to docker.io/library/warp-worker and does not exist).
      WORKER_IMAGE: shahriarraka/warp-worker:latest
      # Network workers attach to. The gateway auto-detects the network it is
      # itself on (inspecting its own container), so this is only a fallback used
      # if detection fails. Compose prefixes networks with the project name, which
      # differs between `docker compose up` in this dir and an OCI deploy - hence
      # the auto-detection. Uncomment/set only to force a specific network.
      # DOCKER_NETWORK: warp-proxy-server_warp_pool_net
      # POOL_MIN_SIZE/POOL_MAX_SIZE/CREATE_BATCH are overridable (warpproxy.Setup
      # forwards them) so the same stack can run a small pool for local
      # development and a full-size one on a deployment VM without editing
      # this file. Defaults below are the production-sized values.
      POOL_MIN_SIZE: "${POOL_MIN_SIZE:-10}"
      POOL_MAX_SIZE: "${POOL_MAX_SIZE:-40}"
      # Reregistration cadence, both overridable (warpproxy.Setup forwards
      # them) so it's tunable from .env without editing this file:
      #  - ROTATE_MAX_AGE_MINUTES: each worker gets a clean reregister (fresh
      #    container -> fresh WARP identity -> new IP) this long after it was
      #    created, +0..ROTATE_JITTER_MINUTES so a 10-worker pool doesn't
      #    reregister all at once.
      #  - FULL_ROTATE_INTERVAL_MINUTES: independent of the per-worker timer
      #    above, the ENTIRE pool is forced through a clean reregister every
      #    this many minutes (still staggered across ROTATE_JITTER_MINUTES,
      #    not all at once). 0 disables it.
      ROTATE_MAX_AGE_MINUTES: "${ROTATE_MAX_AGE_MINUTES:-30}"
      ROTATE_JITTER_MINUTES: "${ROTATE_JITTER_MINUTES:-10}"
      FULL_ROTATE_INTERVAL_MINUTES: "${FULL_ROTATE_INTERVAL_MINUTES:-120}"
      FAIL_THRESHOLD: "5"
      PICK_STRATEGY: "round-robin"     # cycle requests across the pool so consecutive requests use different (unique) egress IPs; set "random" for random pick
      CREATE_BATCH: "${CREATE_BATCH:-3}"   # max workers created per 10s tick (staggers WARP registration to avoid 429s)
      HEALTH_CONCURRENCY: "8"          # max concurrent health probes per cycle
      # Client-facing proxy auth. Set both to require username/password on the
      # SOCKS5 (:1080) and HTTP (:8080) listeners. Unset/empty (the default)
      # means no auth - safe here because the ports above are loopback-only.
      # NOTE: "${VAR-}" (not "${VAR:-default}") - the latter substitutes its
      # default even when VAR is explicitly set to "", so it can never actually
      # be turned off. Chromium/Playwright cannot authenticate proxy connections
      # anyway (no CDP hook wires credentials into --proxy-server), so enabling
      # auth here requires a client that supports HTTP Basic / SOCKS5 RFC1929.
      PROXY_USER: "${PROXY_USER-}"
      PROXY_PASS: "${PROXY_PASS-}"
    volumes:
      # The gateway shells out to the docker CLI to create/remove worker
      # containers, so it needs access to the host's docker socket.
      - /var/run/docker.sock:/var/run/docker.sock

  # Built here so `docker compose build` produces the warp-worker:latest image
  # the gateway references above. This service itself is never started -
  # the gateway creates worker instances on demand.
  worker-image:
    build: ./worker
    image: shahriarraka/warp-worker:latest
    entrypoint: ["true"]
    profiles: ["build-only"]
services:
  gateway:
    image: docker.io/shahriarraka/warp-gateway:latest@sha256:24521afa283928a476ac09ace753eb7352db6f216a75ed73830c95d7197f45a8
  worker-image:
    image: docker.io/shahriarraka/warp-worker:latest@sha256:4d9d510c99a1a8d643bf7d7ef668963263280c4c4d42eec0026cd54379418456