services:
  docksentry:
    image: amayer1983/docksentry:latest
    container_name: docksentry
    restart: unless-stopped
    environment:
      - BOT_TOKEN=${BOT_TOKEN}
      - CHAT_ID=${CHAT_ID}
      - CRON_SCHEDULE=${CRON_SCHEDULE:-0 18 * * *}
      - EXCLUDE_CONTAINERS=${EXCLUDE_CONTAINERS:-}
      - AUTO_SELFUPDATE=${AUTO_SELFUPDATE:-false}
      - LANGUAGE=${LANGUAGE:-en}
      - TZ=${TZ:-Europe/Berlin}
      # The Web UI is off unless you say so. Set WEB_UI=true in your .env
      # and uncomment the `ports:` block below — both are needed, one on
      # its own does nothing. First visit walks you through a password.
      - WEB_UI=${WEB_UI:-false}
      - WEB_PORT=${WEB_PORT:-8080}
    # ports:
    #   - "${WEB_PORT:-8080}:${WEB_PORT:-8080}"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - docksentry_data:/docksentry
      # Docker credentials (for authenticated pulls, avoids rate limits)
      - ${DOCKER_CONFIG:-/root/.docker/config.json}:/.docker/config.json:ro
      # Compose project directories (needed to restart containers).
      # The container side is not freely chosen — Docksentry opens exactly
      # the path in the container's compose label, and /data/compose is what
      # Portainer writes there. Since our own data moved to /docksentry it no
      # longer collides with anything of ours. If you ran `docker compose`
      # yourself the label holds a host path, so edit both sides to that
      # directory. Read-only: we open the compose file to hand it to
      # `docker compose -f`, and never write anything into that tree.
      # Every other example in the docs already said `:ro`; this one has
      # been missing it since v1.7.0. See docs/compose.md.
      - ${COMPOSE_DIR:-/data/compose}:/data/compose:ro
    security_opt:
      - no-new-privileges:true

volumes:
  docksentry_data: