# Muximux Docker Compose
# Usage: docker compose up -d
#
# Environment variables can be used in two ways:
#   1. Direct overrides: MUXIMUX_DATA, MUXIMUX_LISTEN, MUXIMUX_CONFIG (see below)
#   2. Config file expansion: Any ${VAR} in config.yaml is replaced with
#      the environment variable value. Pass vars here and reference them
#      in your config.yaml (e.g., client_secret: ${OIDC_CLIENT_SECRET}).

services:
  muximux:
    image: ghcr.io/mescon/muximux:latest
    container_name: muximux
    init: true
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    ports:
      - "8080:8080"
      # Uncomment if using tls.domain or gateway_sites (the embedded
      # Caddy binds 80 and 443 by default for auto-HTTPS via ACME):
      # - "80:80"    # HTTP→HTTPS redirect + ACME challenges
      # - "443:443"  # HTTPS
      #
      # Alternative for unprivileged-port-only setups: set
      # server.gateway_listen: ":8443" in config.yaml and expose
      # that port instead. Useful when fronting Muximux with another
      # reverse proxy (Cloudflare Tunnel, an upstream Traefik, etc.)
      # that terminates TLS and forwards plain HTTP.
      # - "8443:8443"
    volumes:
      - ./data:/app/data
      # If you have a legacy gateway Caddyfile from 3.0.x, mount it
      # here once; the first boot under 3.1.0 auto-migrates it to
      # server.gateway_sites: YAML and backs the original up with a
      # .pre-3.1.0.bak suffix, then config.yaml is rewritten and the
      # Caddyfile mount is no longer needed:
      # - ./sites.Caddyfile:/app/data/sites.Caddyfile:ro
      #
      # Uncomment to expose the Docker socket so Muximux can scan
      # the daemon for running containers (Settings → Discovery in
      # 3.1.0+). Read-only is enough for discovery; with :ro Muximux
      # reads container metadata but cannot start/stop/build anything.
      # (To also start/stop/restart tracked containers from the
      # dashboard, use the :rw mount in the next block instead.)
      # Mount this only if you trust the dashboard's auth posture - the
      # socket grants effective root on the host.
      # The entrypoint auto-detects the socket's group ownership and
      # grants the runtime user access; no extra env var needed.
      # - /var/run/docker.sock:/var/run/docker.sock:ro
      #
      # Container lifecycle controls (opt-in, 3.1.1+). To let the
      # dashboard start/stop/restart tracked containers, use the :rw
      # mount below INSTEAD of the :ro one above AND set
      # discovery.docker.lifecycle_enabled: true in config.yaml. With
      # :rw + lifecycle_enabled Muximux can start/stop/restart tracked
      # containers (every action audit-logged) but still cannot pull,
      # build, create, destroy, or exec into containers. See
      # docs/wiki/docker-discovery.md#container-lifecycle-controls.
      # - /var/run/docker.sock:/var/run/docker.sock:rw
    environment:
      # ── User/Group ───────────────────────────────────────────────
      - PUID=1000
      - PGID=1000

      # ── Docker socket access (rare overrides) ───────────────────
      # The entrypoint auto-detects the docker socket's group GID
      # when /var/run/docker.sock is mounted. These overrides are
      # only needed for unusual setups: rootless Docker, a
      # docker-socket-proxy sidecar, or a non-default mount path.
      # - DOCKER_SOCKET=/var/run/docker.sock
      # - DOCKER_GID=999

      # ── Timezone ────────────────────────────────────────────────
      - TZ=UTC

      # ── Direct Overrides ────────────────────────────────────────
      # These override the corresponding config.yaml values.
      #
      # Override the data directory (default: /app/data in Docker)
      # - MUXIMUX_DATA=/app/data
      #
      # Override the listen address (default: :8080)
      # - MUXIMUX_LISTEN=:8080
      #
      # Override the config file path (default: derived from data dir)
      # - MUXIMUX_CONFIG=/app/data/config.yaml
      #
      # Automatically import muximux.*-labeled containers (3.2.0+).
      # off (default) | add | update | sync. With sync, Muximux mirrors
      # labeled containers exactly (adds, updates, and removes apps).
      # Enabling this imports every labeled container with no review step,
      # including gateway subdomains. See docs/wiki/docker-discovery.md.
      # - MUXIMUX_DISCOVERY_AUTO_IMPORT=sync

      # ── Config File Variable Expansion ──────────────────────────
      # These are available for ${VAR} expansion inside config.yaml.
      # Example config.yaml usage: client_secret: ${OIDC_CLIENT_SECRET}
      #
      # OIDC authentication secrets
      # - OIDC_CLIENT_ID=muximux
      # - OIDC_CLIENT_SECRET=your-oidc-client-secret
      # - OIDC_ISSUER_URL=https://auth.example.com
      # - OIDC_REDIRECT_URL=https://muximux.example.com/auth/callback
      #
      # API key for external access (auth bypass rules)
      # - MUXIMUX_API_KEY=your-api-key-here
      #
      # Builtin auth password hash (bcrypt)
      # - ADMIN_PASSWORD_HASH=$$2a$$10$$...
      #
      # TLS settings (for auto-HTTPS or manual certs)
      # - TLS_DOMAIN=muximux.example.com
      # - TLS_EMAIL=admin@example.com
      # - TLS_CERT=/app/data/cert.pem
      # - TLS_KEY=/app/data/key.pem
      #
      # App URLs (useful for varying between environments)
      # - PLEX_URL=http://plex:32400
      # - SONARR_URL=http://sonarr:8989
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

# ─── Discovery via Docker labels (3.1.0+) ──────────────────────
#
# Any service you label with muximux.* keys appears in Muximux's
# Discover modal (Settings > Discovery) pre-filled for one-click
# import -- or, with MUXIMUX_DISCOVERY_AUTO_IMPORT /
# discovery.docker.auto_import enabled, is imported automatically
# with no click. The example below shows the full label set; you can
# omit the ones you don't need. See the docker-discovery wiki
# page for the full reference and per-platform setup.
#
# Sketch:
#
# services:
#   sonarr:
#     image: linuxserver/sonarr
#     labels:
#       # Tracking
#       - muximux.discovery.id=sonarr-stable
#       # App fields
#       - muximux.app.name=Sonarr
#       - muximux.app.icon=sonarr
#       - muximux.app.group=Media
#       - muximux.app.port=8989
#       - muximux.app.scheme=http
#       - muximux.app.proxy=true
#       - muximux.app.color=#3498db
#       - muximux.app.min_role=user
#       - muximux.app.allowed_groups=family,admins
#       # Gateway (subdomain + auth gate)
#       - muximux.app.gateway.domain=sonarr.example.com
#       - muximux.gateway.tls=auto
#       - muximux.gateway.require_auth=true

# Optional: Build from source instead of using pre-built image
# services:
#   muximux:
#     build:
#       context: .
#       dockerfile: Dockerfile
#       args:
#         VERSION: "3.2.0"
#     ...