version: '3.5'

services:
  scrutiny:
    restart: unless-stopped
    container_name: scrutiny
    image: ghcr.io/starosdev/scrutiny:latest-omnibus
    cap_add:
      - SYS_RAWIO
      - SYS_ADMIN # Required for NVMe devices
    # AppArmor: on systems with AppArmor enforced (TrueNAS SCALE, Ubuntu, Debian),
    # the default Docker profile blocks raw device I/O even with SYS_RAWIO/SYS_ADMIN.
    # Option 1 (recommended): load the custom profile on the host, then uncomment:
    #   sudo cp docker/apparmor-profile /etc/apparmor.d/scrutiny-collector
    #   sudo apparmor_parser -r /etc/apparmor.d/scrutiny-collector
    # security_opt:
    #   - apparmor=scrutiny-collector
    # Option 2 (less secure): disable AppArmor for this container:
    # security_opt:
    #   - apparmor=unconfined
    ports:
      - "8080:8080" # webapp
      - "8086:8086" # influxDB admin
    volumes:
      - /run/udev:/run/udev:ro
      # Mounting devices individually with device tends to work better
      - /dev:/dev:ro
      # MDADM: Docker blocks direct mounts into /proc, so the collector
      # checks /host/proc/mdstat first, then falls back to /proc/mdstat.
      # Comment out if you don't use MDADM RAID arrays.
      # This only proves the container can read the host file.
      # Platforms such as Unraid expose non-standard mdstat content and may
      # still produce an empty MDADM summary even with this mount present.
      - /proc/mdstat:/host/proc/mdstat:ro
      # Btrfs/filesystem collectors: prefer the host mounts table when running
      # in Docker so container bind mounts do not replace host mount points.
      - /proc/mounts:/host/proc/mounts:ro
      - ./config:/opt/scrutiny/config
      - ./influxdb:/opt/scrutiny/influxdb
      # Btrfs: if your Btrfs volumes are not visible inside the container,
      # bind-mount each host volume path (Synology DSM, similar NAS platforms):
      # - /volume1:/volume1:ro
      # - /volume2:/volume2:ro
    environment:
      # Existing Omnibus installs: stop Scrutiny, back up the complete
      # ./influxdb directory, then set this to "true" for the 2.9 upgrade.
      SCRUTINY_INFLUXDB_29_BACKUP_CONFIRMED: "${SCRUTINY_INFLUXDB_29_BACKUP_CONFIRMED:-false}"
      # Enable ZFS pool monitoring (uncomment to enable)
      # See docs/ZFS_POOL_MONITORING.md for details
      # COLLECTOR_ZFS_CRON_SCHEDULE: "*/15 * * * *"
      # COLLECTOR_ZFS_RUN_STARTUP: "true"
      # Enable MDADM RAID monitoring (uncomment to enable)
      # COLLECTOR_MDADM_CRON_SCHEDULE: "*/15 * * * *"
      # COLLECTOR_MDADM_RUN_STARTUP: "true"
      # Enable Btrfs filesystem monitoring (uncomment to enable)
      # See docs/BTRFS_FILESYSTEM_MONITORING.md for details
      # COLLECTOR_BTRFS_CRON_SCHEDULE: "*/15 * * * *"
      # COLLECTOR_BTRFS_RUN_STARTUP: "true"
      # Enable filesystem capacity monitoring (requires host mount visibility)
      # COLLECTOR_FILESYSTEM_CRON_SCHEDULE: "*/15 * * * *"
      # COLLECTOR_FILESYSTEM_RUN_STARTUP: "true"
      # Authentication (disabled by default, see docs/AUTH.md)
      # SCRUTINY_WEB_AUTH_ENABLED: 'true'
      # SCRUTINY_WEB_AUTH_TOKEN: 'your-secret-api-token'
      # SCRUTINY_WEB_AUTH_ADMIN_PASSWORD: 'your-admin-password'
      # COLLECTOR_API_TOKEN: 'your-secret-api-token'
      # Home Assistant MQTT Discovery (disabled by default)
      # Drives auto-appear in HA when enabled. Requires an MQTT broker.
      # SCRUTINY_WEB_MQTT_ENABLED: 'true'
      # SCRUTINY_WEB_MQTT_BROKER: 'tcp://mosquitto:1883'
      # SCRUTINY_WEB_MQTT_USERNAME: ''
      # SCRUTINY_WEB_MQTT_PASSWORD: ''
    devices:
      - "/dev/sda"
      - "/dev/sdb"
      # NVMe: pass both controller (for SMART) and namespace (for performance benchmarks)
      # - "/dev/nvme0"
      # - "/dev/nvme0n1"