version: '2.4'

services:
  influxdb:
    restart: unless-stopped
    image: influxdb:2.9
    ports:
      - '8086:8086'
    environment:
      INFLUXD_USE_HASHED_TOKENS: "false"
    volumes:
      - './influxdb:/var/lib/influxdb2'
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8086/health"]
      interval: 5s
      timeout: 10s
      retries: 20


  web:
    restart: unless-stopped
    image: 'ghcr.io/starosdev/scrutiny:latest-web'
    ports:
      - '8080:8080'
    volumes:
      - './config:/opt/scrutiny/config'
    environment:
      SCRUTINY_WEB_INFLUXDB_HOST: 'influxdb'
      # Authentication (disabled by default, see docs/AUTH.md)
      # SCRUTINY_WEB_AUTH_ENABLED: 'true'
      # SCRUTINY_WEB_AUTH_TOKEN: 'your-secret-api-token'
      # SCRUTINY_WEB_AUTH_ADMIN_PASSWORD: 'your-admin-password'
      # SCRUTINY_WEB_METRICS_TOKEN: 'your-metrics-token'
      # Home Assistant MQTT Discovery (disabled by default)
      # Drives auto-appear in HA when enabled. Requires an MQTT broker.
      # SCRUTINY_WEB_MQTT_ENABLED: 'true'
      # SCRUTINY_WEB_MQTT_BROKER: 'tcp://mosquitto:1883'
      # SCRUTINY_WEB_MQTT_USERNAME: ''
      # SCRUTINY_WEB_MQTT_PASSWORD: ''
    depends_on:
      influxdb:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/health"]
      interval: 5s
      timeout: 10s
      retries: 20
      start_period: 10s

  collector:
    restart: unless-stopped
    image: 'ghcr.io/starosdev/scrutiny:latest-collector-omnibus'
    cap_add:
      - SYS_RAWIO
      - SYS_ADMIN  # Required for NVMe devices
    # Use latest-collector instead if you only want SMART metrics in this spoke.
    # AppArmor: on systems with AppArmor enforced (TrueNAS SCALE, Ubuntu, Debian),
    # the default Docker profile blocks raw device I/O even with SYS_RAWIO/SYS_ADMIN.
    # Option 1 (recommended): load the custom profile on the host, then uncomment:
    #   sudo cp docker/apparmor-profile /etc/apparmor.d/scrutiny-collector
    #   sudo apparmor_parser -r /etc/apparmor.d/scrutiny-collector
    # security_opt:
    #   - apparmor=scrutiny-collector
    # Option 2 (less secure): disable AppArmor for this container:
    # security_opt:
    #   - apparmor=unconfined
    volumes:
      - '/run/udev:/run/udev:ro'
      # Filesystem/Btrfs collectors need host mount visibility:
      # - '/mnt:/mnt:ro'
      # - '/var/lib/btrfs:/var/lib/btrfs:ro'
      # MDADM collector needs host mdstat and broad device visibility:
      # - '/dev:/dev'
      # - '/proc/mdstat:/host/proc/mdstat:ro'
      # Performance collector can use mounted filesystem paths for fio targets:
      # - '/mnt/data:/mnt/data'
      # - '/mnt/backup:/mnt/backup'
    environment:
      COLLECTOR_API_ENDPOINT: 'http://web:8080'
      COLLECTOR_HOST_ID: 'scrutiny-collector-hostname'
      # If true forces the collector to run on startup (cron will be started after the collector completes)
      # see: https://github.com/Starosdev/scrutiny/blob/master/docs/TROUBLESHOOTING_DEVICE_COLLECTOR.md#collector-trigger-on-startup
      COLLECTOR_RUN_STARTUP: false
      # Optional collectors stay disabled until their own schedules or run-on-startup flags are set.
      # COLLECTOR_ZFS_CRON_SCHEDULE: '*/15 * * * *'
      # COLLECTOR_ZFS_RUN_STARTUP: 'true'
      # COLLECTOR_MDADM_CRON_SCHEDULE: '*/15 * * * *'
      # COLLECTOR_MDADM_RUN_STARTUP: 'true'
      # COLLECTOR_BTRFS_CRON_SCHEDULE: '*/15 * * * *'
      # COLLECTOR_BTRFS_RUN_STARTUP: 'true'
      # COLLECTOR_FILESYSTEM_CRON_SCHEDULE: '*/15 * * * *'
      # COLLECTOR_FILESYSTEM_RUN_STARTUP: 'true'
      # COLLECTOR_PERF_CRON_SCHEDULE: '0 2 * * 0'
      # COLLECTOR_PERF_RUN_STARTUP: 'false'
      # COLLECTOR_PERF_PROFILE: 'quick'
      # COLLECTOR_PERFORMANCE_MOUNT_POINTS_SDA: '/mnt/data'
      # COLLECTOR_PERFORMANCE_MOUNT_POINTS_SDB: '/mnt/backup'
      # Required when server auth is enabled (must match SCRUTINY_WEB_AUTH_TOKEN)
      # COLLECTOR_API_TOKEN: 'your-secret-api-token'
    depends_on:
      web:
        condition: service_healthy
    devices:
      - "/dev/sda"
      - "/dev/sdb"
      # NVMe: pass both controller (for SMART) and namespace (for performance benchmarks)
      # - "/dev/nvme0"
      # - "/dev/nvme0n1"

  # Smaller dedicated collector images remain available when you do not want the collector omnibus image:
  # See docs/ZFS_POOL_MONITORING.md for details
  # collector-zfs:
  #   restart: unless-stopped
  #   image: 'ghcr.io/starosdev/scrutiny:latest-collector-zfs'
  #   environment:
  #     COLLECTOR_ZFS_API_ENDPOINT: 'http://web:8080'
  #     COLLECTOR_ZFS_HOST_ID: 'zfs-host'
  #     COLLECTOR_ZFS_RUN_STARTUP: 'true'
  #   depends_on:
  #     web:
  #       condition: service_healthy

  # Btrfs Filesystem Collector (optional - only needed if you use Btrfs)
  # See docs/BTRFS_FILESYSTEM_MONITORING.md for details
  # collector-btrfs:
  #   restart: unless-stopped
  #   image: 'ghcr.io/starosdev/scrutiny:latest-collector-btrfs'
  #   cap_add:
  #     - SYS_ADMIN
  #   volumes:
  #     - '/mnt:/mnt:ro'
  #     - '/var/lib/btrfs:/var/lib/btrfs:ro'
  #   environment:
  #     COLLECTOR_BTRFS_API_ENDPOINT: 'http://web:8080'
  #     COLLECTOR_BTRFS_HOST_ID: 'btrfs-host'
  #     COLLECTOR_BTRFS_RUN_STARTUP: 'true'
  #   depends_on:
  #     web:
  #       condition: service_healthy

  # Performance Benchmark Collector (optional - for fio-based drive benchmarking)
  # Runs fio benchmarks on drives and tracks throughput, IOPS, and latency over time.
  # Default schedule: Sunday 2 AM. Requires device access and mounted filesystems.
  # For best results, volume-mount the host filesystem paths and configure mount_points
  # so the collector benchmarks the actual filesystem rather than using raw device I/O.
  # collector-performance:
  #   restart: unless-stopped
  #   image: 'ghcr.io/starosdev/scrutiny:latest-collector-performance'
  #   cap_add:
  #     - SYS_RAWIO
  #     - SYS_ADMIN  # Required for NVMe and USB/SAT devices
  #   volumes:
  #     - '/run/udev:/run/udev:ro'
  #     - '/mnt/data:/mnt/data'        # Mount host filesystem for sda benchmarks
  #     - '/mnt/backup:/mnt/backup'    # Mount host filesystem for sdb benchmarks
  #   environment:
  #     COLLECTOR_PERF_API_ENDPOINT: 'http://web:8080'
  #     COLLECTOR_PERF_HOST_ID: 'scrutiny-collector-hostname'
  #     COLLECTOR_PERF_CRON_SCHEDULE: '0 2 * * 0'  # Sunday at 2 AM
  #     COLLECTOR_PERF_RUN_STARTUP: 'false'
  #     COLLECTOR_PERF_PROFILE: 'quick'  # 'quick' (~60s/device) or 'comprehensive' (~300s/device)
  #     # Map devices to their host mount points (avoids raw block device fallback):
  #     COLLECTOR_PERFORMANCE_MOUNT_POINTS_SDA: '/mnt/data'
  #     COLLECTOR_PERFORMANCE_MOUNT_POINTS_SDB: '/mnt/backup'
  #   depends_on:
  #     web:
  #       condition: service_healthy
  #   devices:
  #     - "/dev/sda"
  #     - "/dev/sdb"
  #     # NVMe: pass both controller and namespace for performance benchmarks
  #     # - "/dev/nvme0"
  #     # - "/dev/nvme0n1"
  # MDADM Software RAID Collector (optional - only needed if you use Linux mdadm RAID)
  # collector-mdadm:
  #   restart: unless-stopped
  #   image: 'ghcr.io/starosdev/scrutiny:latest-collector-mdadm'
  #   cap_add:
  #     - SYS_ADMIN # Required for mdadm --detail and block device access
  #   volumes:
  #     - '/dev:/dev' # Mapping the whole /dev is recommended for RAID discovery
  #     - '/proc/mdstat:/host/proc/mdstat:ro' # Required so the container can read host mdstat
  #   environment:
  #     COLLECTOR_MDADM_API_ENDPOINT: 'http://web:8080'
  #     COLLECTOR_MDADM_HOST_ID: 'raid-host'
  #     COLLECTOR_MDADM_RUN_STARTUP: 'true'
  #   depends_on:
  #     web:
  #       condition: service_healthy