services:
  ha-login-approval:
    image: ghcr.io/nebur692/ha-login-approval:latest
    restart: unless-stopped
    ports:
      - 8000:8000
    volumes:
      - ./data:/data
    environment:
      - HA_BASE_URL=http://homeassistant.local:8123
      - HA_TOKEN=your_long_lived_ha_token_here
      - ADMIN_USERNAME=admin
      - ADMIN_PASSWORD=change_this_to_12_or_more_characters
      # The service runs as this user and group, never root (Unraid: 99 / 100)
      - PUID=1000
      - PGID=1000
      # Passwordless OIDC provider — works with ZITADEL, Keycloak, Authentik,
      # or any RP that supports a generic external OIDC provider.
      # IDP_ISSUER_URL must be a PUBLIC https:// URL behind your reverse
      # proxy, not a local IP — otherwise nobody can sign in from outside
      # your own network.
      - IDP_ISSUER_URL=https://your-public-domain.example.com
      - IDP_CLIENT_ID=ha-login-approval
      - IDP_CLIENT_SECRET=change_this_to_a_long_random_value
      - IDP_CLIENT_REDIRECT_URI=https://your-idp.example.com/idps/callback
      - APPROVAL_TIMEOUT_SECONDS=120
      # Optional GeoIP enrichment (self-hosted MaxMind GeoLite2) — leave unset to skip
      # - GEOIP_ACCOUNT_ID=your_maxmind_account_id
      # - GEOIP_LICENSE_KEY=your_maxmind_license_key
      # Optional, ZITADEL only: name the app in the notification (read-only service user)
      # - ZITADEL_API_URL=https://sso.example.com
      # - ZITADEL_API_CLIENT_ID=your_service_user_client_id
      # - ZITADEL_API_CLIENT_SECRET=your_service_user_client_secret