# Reference deployment: a single manager container that controls Docker through
# the host's Docker socket, mounted directly (DOCKER_HOST=unix:///var/run/docker.sock).
#
# If you prefer least-privilege Docker access, put a tecnativa/docker-socket-proxy
# in front instead: give it the socket, set the manager's DOCKER_HOST to
# tcp://socket-proxy:2375, and drop the socket bind mount below.
#
# On Unraid, set HOST_DATA_DIR to the real appdata path so bind mounts for the
# spawned game containers resolve correctly on the host, e.g.
#   HOST_DATA_DIR=/mnt/user/appdata/ark-manager
name: palisade

services:
  manager:
    image: ghcr.io/shakes63/palisade:latest
    build:
      context: .
      dockerfile: Dockerfile
    container_name: palisade
    environment:
      NODE_ENV: production
      API_PORT: 8787
      WEB_PORT: 3000
      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:3000}
      DATA_DIR: /data
      DATABASE_URL: file:/data/db.sqlite
      HOST_DATA_DIR: ${HOST_DATA_DIR:-/mnt/user/appdata/ark-manager}
      DOCKER_HOST: unix:///var/run/docker.sock
      SECRETS_KEY: ${SECRETS_KEY:?set a 64-hex-char SECRETS_KEY}
      JWT_SECRET: ${JWT_SECRET:?set a JWT_SECRET}
      PUID: ${PUID:-99}
      PGID: ${PGID:-100}
      TZ: ${TZ:-UTC}
      # Run game containers on the host network (removes Docker NAT → more reliable
      # ASA/EOS public listing). When on, the manager reaches RCON via
      # host.docker.internal (see extra_hosts below). Default off = ark-net bridge.
      GAME_HOST_NETWORK: ${GAME_HOST_NETWORK:-false}
    volumes:
      - ${HOST_DATA_DIR:-./data}:/data
      # Direct Docker control. The manager runs as root in-container, so it can use
      # the root:docker-owned host socket without a group-add.
      - /var/run/docker.sock:/var/run/docker.sock
    # Lets the manager reach game-container RCON via host.docker.internal when
    # GAME_HOST_NETWORK is on; harmless when it's off.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "3000:3000" # web UI
      - "8787:8787" # API (optional to expose; web can proxy)
    networks: [ark-net]
    restart: unless-stopped

networks:
  ark-net:
    name: ark-net