version: '3.8'

services:
  unraid-config-guardian:
    build: .
    container_name: unraid-config-guardian
    restart: unless-stopped

    environment:
      # Unraid user/group mapping
      - PUID=99                    # nobody user
      - PGID=100                   # users group
      - TZ=America/New_York        # Adjust to your timezone

      # Docker connection (uses socket proxy for security)
      - DOCKER_HOST=tcp://docker-socket-proxy:2375

      # Backup configuration
      - SCHEDULE=0 2 * * 0         # Weekly Sunday at 2 AM
      - BACKUP_LOCATION=/output
      - MASK_PASSWORDS=true
      # - MASK_EXTRA_KEYWORDS=rcon,webui_user   # Extra keywords to mask, comma-separated
      - INCLUDE_SYSTEM_INFO=true
      - DEBUG=false

      # Optional: Notification settings
      # - WEBHOOK_URL=https://hooks.slack.com/services/your/webhook/url
      # - EMAIL_NOTIFICATIONS=admin@yourdomain.com

    volumes:
      # Application configuration
      - /mnt/user/appdata/unraid-config-guardian:/config

      # Output directory for generated documentation
      - /mnt/user/backups/unraid-docs:/output

      # Docker socket proxy connection (requires docker-socket-proxy container)

      # Unraid flash drive configuration (read-only)
      - /boot:/boot:ro

      # Optional: Additional system paths for comprehensive backup
      # - /mnt/user:/mnt/user:ro
      # - /etc/unraid:/etc/unraid:ro

    networks:
      - unraid-guardian

    # Web interface port
    ports:
      - "7842:7842"

    # Security settings
    security_opt:
      - no-new-privileges:true

    # Resource limits
    mem_limit: 1g
    cpus: 0.5

    # Health check
    healthcheck:
      test: ["CMD", "python", "src/health_check.py"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Docker Socket Proxy for secure Docker access
  docker-socket-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: docker-socket-proxy
    restart: unless-stopped
    environment:
      - CONTAINERS=1    # Allow container inspection
      - IMAGES=1        # Allow image inspection
      - INFO=1          # Allow system info
      - NETWORKS=1      # Allow network inspection
      - VOLUMES=1       # Allow volume inspection
      - POST=0          # Disable container creation/modification
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - unraid-guardian

networks:
  unraid-guardian:
    driver: bridge