# Boots a real Windows VM inside a container via dockur/windows (QEMU+KVM
# under the hood, no Windows license/key needed for the eval install it
# fetches automatically). Persistent disk lives in ./storage, so the
# one-time provisioning in oem/install.bat only ever runs once -- every
# later `docker compose up` just boots the already-provisioned VM.
#
# Requires /dev/kvm on the host (check with: ls -la /dev/kvm, and that
# your user is in the `kvm` group).
#
# Volumes use the :Z suffix (SELinux relabeling for a container-private
# label) -- confirmed needed on this host (Fedora, SELinux enforcing):
# without it dockur/windows refuses to start with "Storage folder
# (/storage) is not writeable!" even though normal Unix permissions are
# fine. Harmless no-op on a host without SELinux.
services:
  windows:
    image: dockurr/windows
    container_name: fenigma-windows-builder
    environment:
      VERSION: "11"       # Windows 11 Pro, fetched+installed unattended on first boot
      RAM_SIZE: "8G"
      CPU_CORES: "4"
      DISK_SIZE: "80G"    # MSYS2 + GTK4/libadwaita + WiX + build tree eats more than the 64G default
    devices:
      - /dev/kvm
      - /dev/net/tun
    cap_add:
      - NET_ADMIN
    ports:
      - "8006:8006"       # noVNC web viewer, http://localhost:8006 -- watch the first install here
      - "3389:3389/tcp"   # RDP, if you'd rather use an RDP client
    volumes:
      - ./storage:/storage:Z        # persistent VM disk
      - ./oem:/oem:Z                # one-time provisioning payload, copied to C:\OEM on first install
      - ./shared:/shared:Z          # live exchange folder, appears as Z:\ in Windows
    stop_grace_period: 2m
    restart: unless-stopped