services:
  lanlens:
    image: alexrosbach/lanlens:latest
    # To build locally instead of pulling from Docker Hub, uncomment:
    # build: .
    container_name: lanlens
    restart: unless-stopped

    # Required for ARP scanning: container must share the host network stack
    # so scapy can send raw Ethernet frames via the host's physical NIC.
    # Remove this and uncomment 'ports' below to use bridge networking —
    # but note that ARP scanning will not work in bridge mode.
    network_mode: host
    cap_add:
      - NET_ADMIN  # network interface configuration
      - NET_RAW    # raw socket access for ARP broadcast

    volumes:
      - lanlens_data:/data  # SQLite database + persistent state

    environment:
      # ── OPTIONAL ──────────────────────────────────────────────────────────────
      # SECRET_KEY is generated once into the lanlens_data volume when omitted.
      # Set it manually only if you need to restore/migrate encrypted credentials.
      # - SECRET_KEY=your-64-char-random-string
      # Persistent REST API Bearer token (minimum 32 characters, read-only by default)
      # - LANLENS_API_TOKEN=generate-a-long-random-token
      # Set false only when this token must call POST/PUT/PATCH/DELETE endpoints
      # - LANLENS_API_TOKEN_READ_ONLY=true
      # Initial admin password (will be changed on first login)
      - DEFAULT_ADMIN_PASSWORD=admin
      # Host-mode HTTP port for the LanLens UI (for example 80, 8080, 7765)
      - LANLENS_PORT=7765
      # Internal API port used behind nginx (leave as-is unless you know why)
      - BACKEND_PORT=17765
      # Timezone (e.g. Europe/Berlin, America/New_York, UTC)
      - TZ=Europe/Berlin

    # Host mode still allows a custom HTTP port.
    # Example: set LANLENS_PORT=80 above if you want LanLens on port 80.
    # Optional built-in HTTPS can be enabled in Settings → System after startup.

    # ── Bridge networking alternative (ARP scanning disabled) ─────────────────
    # Comment out network_mode and cap_add above, then uncomment:
    # ports:
    #   - "8080:8080"
    # and set LANLENS_PORT=8080 above so nginx listens on the same port.

    healthcheck:
      test: ["CMD-SHELL", "if python -c 'import json,sys; data=json.load(open(\"/data/tls/config.json\")); sys.exit(0 if data.get(\"enabled\") else 1)' 2>/dev/null; then port=$$(python -c 'import json; print(json.load(open(\"/data/tls/config.json\")).get(\"port\") or \"\")' 2>/dev/null); curl -kfs https://localhost:$${port:-$${LANLENS_PORT:-7765}}/api/health; else curl -fs http://localhost:$${LANLENS_PORT:-7765}/api/health; fi"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s

volumes:
  lanlens_data:
    driver: local