name: stackyard

services:
  stackyard:
    container_name: stackyard
    image: ghcr.io/sandobserver/stackyard:latest
    restart: unless-stopped
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - CHOWN
      - SETUID
      - SETGID
      - DAC_OVERRIDE
    security_opt:
      - no-new-privileges:true
    privileged: false
    mem_limit: 384m
    mem_reservation: 96m
    memswap_limit: 384m
    cpu_shares: 90
    pids_limit: 256
    ports:
      - "8700:80"
    # Allows the container to reach services on the host by IP (e.g. http://192.168.1.100:8989).
    # On Linux, containers cannot reach the host's LAN IP without this.
    # host-gateway is a Docker built-in that resolves to the host machine's IP.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - ./data:/data
      - ./icons:/icons
      # Optional: CPU temperature sensors
      # - /sys/class/thermal:/sys/class/thermal:ro
      # Optional: disk usage monitoring (add your mount paths)
      # - /mnt/your-drive:/mnt/your-drive:ro
    environment:
      # Set these either here, by replacing the value after the colon-dash, or in
      # a .env file beside this one, or in your Docker UI's environment editor.
      # An empty value means the built-in default.
      #
      # Socket proxy URL for Docker container health monitoring.
      - SOCKET_PROXY_URL=${SOCKET_PROXY_URL:-}
      # Set to true if behind a reverse proxy (Nginx Proxy Manager, Traefik, etc.)
      - TRUST_PROXY=${TRUST_PROXY:-}
      # Where your reverse proxy is, if you have one in front (Nginx Proxy
      # Manager, Caddy, Traefik), for example 172.18.0.0/16. Without this, every
      # request through it counts as one client for rate limiting. See
      # docs/security.md.
      - TRUSTED_PROXY=${TRUSTED_PROXY:-}
      # Memory used per password hash. Default 16mib suits small hardware;
      # raise it if you can, for example 64mib. See docs/security.md.
      - PASSWORD_HASH_MEMORY=${PASSWORD_HASH_MEMORY:-}
      # Turns the SSRF guard off, so badges and widgets may reach private, LAN
      # and loopback addresses. Most homelab installs need it, because the
      # services they point at live on private IPs. See docs/security.md.
      - ALLOW_PRIVATE_IPS=${ALLOW_PRIVATE_IPS:-}
      # Log verbosity: debug, info, warn or error, where warn and error behave
      # the same. Settings, General sets this too, and that wins once the config
      # has loaded.
      - LOG_LEVEL=${LOG_LEVEL:-}
      # Run as a read-only public showcase. See docs/demo.md.
      - DEMO_MODE=${DEMO_MODE:-}
      # Idle session lifetime in days before re-login is required (default 12
      # hours). Accepts a fraction. A session in use is extended automatically.
      - SESSION_MAX_AGE_DAYS=${SESSION_MAX_AGE_DAYS:-}
      # Internal paths and port. Change only if you have moved them.
      # - CONFIG_PATH=/data/apps.json
      # - ICONS_PATH=/icons
      # - PORT=3000
      # - WIDGETS_PATH=/usr/share/nginx/html/widgets
    healthcheck:
      test:
        - CMD
        - wget
        - "-qO-"
        - http://localhost/health
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - stackyard_network
      # Add your reverse proxy network here, e.g.:
      # - proxy-net

networks:
  stackyard_network:
    name: stackyard_network
    driver: bridge
  # proxy-net:
  #   name: proxy-net
  #   external: true