services:
  maison:
    image: maison:latest
    build: .
    container_name: maison
    hostname: maison
    restart: unless-stopped
    ports:
      # Host port is configurable; the container always listens on 8080.
      - "${HOST_PORT:-8080}:8080"
    environment:
      # Path INSIDE the container where the data folder is mounted (fixed target).
      DATA_ROOT: "/DATA"
      # Path on the HOST of that SAME data folder. Apps installed by Maison bind
      # their volumes to the host daemon, so their compose files must reference
      # this host path (not the in-container /DATA). Set it to wherever DATA_HOST_PATH
      # points below. Must match the bind `source` under `volumes`.
      DATA_HOST_PATH: "${DATA_HOST_PATH:-/DATA}"
      PUID: "1000"
      PGID: "1000"
      TZ: "${TZ:-UTC}"
      # NOTE: the variables Maison forwards to the apps it installs (APP_NET,
      # APP_DOMAIN, APP_PUBLIC_IP_DASH, …) are deliberately NOT here. They live in
      # the deployment's own file, ${DATA_HOST_PATH}/AppData/maison/.env.app,
      # which Maison creates with a documented default on first boot. Keeping them
      # out of this compose is what keeps the two apart: this block is what Maison
      # needs to run; .env.app is what an app receives. See docs/app-env.md.
      APPSTORE_URL: "https://github.com/Yundera/AppStore/archive/refs/heads/main.zip"
      # Where the HOST's /proc is readable (see the mount below). Most of /proc is
      # not namespaced, so CPU/memory/disk-IO already report the host without it;
      # this is what makes the Resources page's network counters, process list and
      # mount names the box's rather than this container's.
      HOST_PROC: "/host/proc"
    # The Docker socket is root-owned here; grant the group so a non-root process
    # could reach it. On most hosts the socket is in the "docker" group.
    group_add:
      - "${DOCKER_GID:-999}"
    networks:
      - mesh
    volumes:
      # Bind the host data folder to /DATA. `source` MUST equal DATA_HOST_PATH so
      # that Maison and the apps it installs agree on where data lives.
      - type: bind
        source: ${DATA_HOST_PATH:-/DATA}
        target: /DATA
        bind:
          propagation: rshared
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
      # Read-only host /proc, paired with HOST_PROC above. Not a new capability:
      # the docker socket mounted above is already root-equivalent on the host.
      - type: bind
        source: /proc
        target: /host/proc
        read_only: true

networks:
  mesh:
    driver: bridge
    name: mesh