services:
  rackpad:
    image: ${RACKPAD_IMAGE:-ghcr.io/kobii-git/rackpad}:${RACKPAD_TAG:-latest}
    container_name: rackpad
    init: true
    restart: unless-stopped
    environment:
      NODE_ENV: production
      HOST: 0.0.0.0
      PORT: 3000
      DATABASE_PATH: /data/rackpad.db
      MONITOR_INTERVAL_MS: ${MONITOR_INTERVAL_MS:-300000}
      DISCOVERY_SCAN_SCHEDULE_INTERVAL_MS: ${DISCOVERY_SCAN_SCHEDULE_INTERVAL_MS:-60000}
      DOCKER_STATUS_SYNC_INTERVAL_MS: ${DOCKER_STATUS_SYNC_INTERVAL_MS:-300000}
      INTEGRATION_STATUS_SYNC_INTERVAL_MS: ${INTEGRATION_STATUS_SYNC_INTERVAL_MS:-300000}
      RACKPAD_NATIVE_BACKUP_DIR: ${RACKPAD_NATIVE_BACKUP_DIR:-}
      TRUST_PROXY: ${TRUST_PROXY:-0}
      TRUSTED_HOSTS: ${TRUSTED_HOSTS:-}
      TRUSTED_ORIGINS: ${TRUSTED_ORIGINS:-}
      MCP_ENABLED: ${MCP_ENABLED:-0}
      RACKPAD_RATE_LIMIT_DISABLED: ${RACKPAD_RATE_LIMIT_DISABLED:-0}
      RACKPAD_RATE_LIMIT_MAX: ${RACKPAD_RATE_LIMIT_MAX:-600}
      RACKPAD_RATE_LIMIT_WINDOW: ${RACKPAD_RATE_LIMIT_WINDOW:-1 minute}
      APP_URL: ${APP_URL:-}
      OIDC_ENABLED: ${OIDC_ENABLED:-0}
      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL:-}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-}
      OIDC_LABEL: ${OIDC_LABEL:-OIDC}
      OIDC_DEFAULT_ROLE: ${OIDC_DEFAULT_ROLE:-viewer}
      OIDC_CLIENT_AUTH_METHOD: ${OIDC_CLIENT_AUTH_METHOD:-client_secret_basic}
      OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email}
      OIDC_USERNAME_CLAIM: ${OIDC_USERNAME_CLAIM:-preferred_username}
      OIDC_DISPLAY_NAME_CLAIM: ${OIDC_DISPLAY_NAME_CLAIM:-name}
      OIDC_ROLE_CLAIM: ${OIDC_ROLE_CLAIM:-groups}
      OIDC_ALLOWED_DOMAINS: ${OIDC_ALLOWED_DOMAINS:-}
      OIDC_DEBUG: ${OIDC_DEBUG:-0}
      OIDC_ADMIN_USERS: ${OIDC_ADMIN_USERS:-}
      OIDC_EDITOR_USERS: ${OIDC_EDITOR_USERS:-}
      OIDC_VIEWER_USERS: ${OIDC_VIEWER_USERS:-}
      OIDC_ADMIN_GROUPS: ${OIDC_ADMIN_GROUPS:-}
      OIDC_EDITOR_GROUPS: ${OIDC_EDITOR_GROUPS:-}
      OIDC_VIEWER_GROUPS: ${OIDC_VIEWER_GROUPS:-}
      OUI_AUTO_UPDATE: ${OUI_AUTO_UPDATE:-1}
      DISCOVERY_MAC_SCAN_MODE: ${DISCOVERY_MAC_SCAN_MODE:-auto}
      DISCOVERY_SCAN_MAX_ACTIVE: ${DISCOVERY_SCAN_MAX_ACTIVE:-2}
      DISCOVERY_SCAN_MAX_ACTIVE_PER_LAB: ${DISCOVERY_SCAN_MAX_ACTIVE_PER_LAB:-1}
      DISCOVERY_SCAN_MAX_QUEUED: ${DISCOVERY_SCAN_MAX_QUEUED:-32}
      RACKPAD_SECRET_KEY: ${RACKPAD_SECRET_KEY:-}
      SNMP_INVENTORY_SYNC: ${SNMP_INVENTORY_SYNC:-0}
      SNMP_TRAP_ENABLED: ${SNMP_TRAP_ENABLED:-0}
      SNMP_TRAP_PORT: ${SNMP_TRAP_PORT:-1162}
      SNMP_TRAP_BIND: ${SNMP_TRAP_BIND:-0.0.0.0}
    ports:
      - "${RACKPAD_PORT:-3000}:3000"
    volumes:
      - rackpad_data:/data
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "const configuredPort = Number(process.env.PORT); const port = Number.isSafeInteger(configuredPort) && configuredPort > 0 ? configuredPort : 3000; fetch('http://127.0.0.1:' + port + '/api/health').then((res) => process.exit(res.ok ? 0 : 1)).catch(() => process.exit(1))",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

volumes:
  rackpad_data: