# ===========================================
# MynetworK Dashboard - Docker Compose (Production)
# ===========================================
#
# Docker Compose configuration for PRODUCTION
# 
# Usage:
#   docker-compose up -d
#   docker-compose pull && docker-compose up -d  # Update and restart
#
# Environment variables:
#   DASHBOARD_PORT - Dashboard port (default: 7505)
#   JWT_SECRET     - JWT secret for authentication (REQUIRED - use .env file)
#   FREEBOX_HOST   - Freebox server hostname (default: mafreebox.freebox.fr)
#   PUBLIC_URL     - Public URL if using reverse proxy (optional)
#
# IMPORTANT: Create a .env file with JWT_SECRET before starting:
#   JWT_SECRET=$(openssl rand -base64 32)
#   echo "JWT_SECRET=$JWT_SECRET" > .env

services:
  mynetwork:
    image: ghcr.io/erreur32/mynetwork:latest
    container_name: mynetwork
    restart: unless-stopped

    ports:
      # Dashboard port mapping: host port → container port 3000
      - "${DASHBOARD_PORT:-7555}:3000"

    environment:
      # 🔐 SECRET OBLIGATOIRE - JWT secret for authentication
      # ⚠️ CRITICAL SECURITY: Never use default secret in production!
      # Generate with: openssl rand -base64 32
      # Store in .env file: JWT_SECRET=votre_secret_genere
      JWT_SECRET: ${JWT_SECRET}

      # Dashboard port mapping (host port → container port 3000)
      # This is the port exposed on the host machine
      # Must match the port in the "ports" section above
      DASHBOARD_PORT: ${DASHBOARD_PORT:-7555}
      
      # Timezone for logs (uses host timezone by default)
      # Override with e.g. TZ=America/New_York in your .env file
      TZ: ${TZ:-Europe/Paris}

      # Host machine IP address (optional, for better log display)
      # If not set, the container will try to auto-detect from Docker gateway
      # Example: HOST_IP=192.168.1.100
      HOST_IP: ${HOST_IP:-}

      # Configuration file path (optional external config file)
      CONFIG_FILE_PATH: ${CONFIG_FILE_PATH:-/app/config/mynetwork.conf}
      # Freebox configuration
      FREEBOX_HOST: ${FREEBOX_HOST:-mafreebox.freebox.fr}
      FREEBOX_TOKEN_FILE: /app/data/freebox_token.json

      # Host metrics access (read-only mount of host filesystem)
      # Used to read hostname, disk usage, and system info from the host
      HOST_ROOT_PATH: ${HOST_ROOT_PATH:-/host}

      # PUBLIC_URL (only if using reverse proxy like nginx)
      # Uncomment and set if accessing via domain name instead of IP:port
      # PUBLIC_URL: https://dashboard.example.com

    volumes:
      # Persistent storage for:
      # - Freebox authentication token (freebox_token.json)
      # - SQLite database (dashboard.db)
      # - IEEE OUI vendor database file (oui.txt)
      # - Application configuration
      - ./data:/app/data
      # Mount host /proc and /sys (read-only) for CPU, memory, network stats, ARP table, hostname
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      # Mount specific host files needed for hostname resolution and system info
      - /etc/hostname:/host/etc/hostname:ro
      - /etc/hosts:/host/etc/hosts:ro

      # ⚠️  SECURITY: Docker socket access (OPTIONAL — disabled by default)
      # Grants read access to Docker API. If the container is compromised,
      # an attacker could inspect/control other containers.
      # Only enable if you need Docker version/stats in the System widget.
      # - /var/run/docker.sock:/var/run/docker.sock:ro

      # ⚠️  SECURITY: Full host root mount (OPTIONAL — disabled by default)
      # Mounts the entire host filesystem read-only. Required ONLY for host disk usage (df).
      # If you don't need disk usage in the System widget, leave this disabled.
      # - /:/host:ro

      # Optional: Mount external configuration file
      # Uncomment the line below to use an external config file
      # - ./config/mynetwork.conf:/app/config/mynetwork.conf:ro

    # Network capabilities required for network scanning (Plugin Scan Réseau)
    # NET_RAW: Required to send ICMP packets (ping) and arping (direct ARP requests)
    # NET_ADMIN: Required for ARP table access (ip neigh) and network interface queries
    # ⚠️  SECURITY: These capabilities expand the container's network attack surface.
    #    They are required for ping/ARP scanning to work. If you don't use the
    #    network scan plugin, you can safely remove them.
    cap_add:
      - NET_RAW
      - NET_ADMIN
      - SETUID
      - SETGID
    cap_drop:
      - ALL

    # OPTIONAL: Use host network mode for better MAC/vendor detection
    # In bridge mode (default), the container reads the host's ARP table via /host/proc/net/arp.
    # In host network mode, arping can directly resolve MACs on the LAN for maximum reliability.
    # To enable, uncomment the line below and remove the "ports" section above:
    # network_mode: host

    # Health check: verify container is responding to API requests
    # Uses wget (available in Alpine base image) to check /api/health endpoint
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s


    # Resource limits (optional)
    # deploy:
    #   resources:
    #     limits:
    #       cpus: '0.5'
    #       memory: 512M
    #     reservations:
    #       cpus: '0.1'
    #       memory: 256M