version: "3.8"
services:
  netalertx-caddy:
    network_mode: host
    image: docker.io/library/caddy:latest
    pull: missing
    container_name: netalertx-caddy

    env_file:
      - .env.caddy

    environment:
      CADDY_DOCKER_CADDYFILE_PATH: "/etc/caddy/Caddyfile"

    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro,z
      - /var/lib/containers/data/netalertx/caddy:/data/caddy:rw,z
      - /var/lib/containers/log/netalertx/caddy:/var/log:rw,z
      - /var/lib/containers/config/netalertx/caddy:/config/caddy:rw,z
      - /var/lib/containers/certificates/letsencrypt:/certificates:ro,z

    # Security Settings
    security_opt:
      - no-new-privileges:true
    
    # Automatically restart Container
    restart: always

  netalertx-server:
    network_mode: host   # Use host networking for ARP scanning and other services

    #build:
    #  context: .                                    # Build context is the current directory
    #  dockerfile: Dockerfile                        # Specify the Dockerfile to use

    depends_on:
      netalertx-caddy:
        condition: service_started
        restart: true

    image: ghcr.io/jokob-sk/netalertx:latest
    container_name: netalertx-server                # The name when you docker contiainer ls
    read_only: true                                 # Make the container filesystem read-only
    
    # It is most secure to start with user 20211, but then we lose provisioning capabilities.
    # user: "${NETALERTX_UID:-20211}:${NETALERTX_GID:-20211}"
    cap_drop:                                       # Drop all capabilities for enhanced security
      - ALL
    cap_add:                                        # Add only the necessary capabilities
      - NET_ADMIN                                   # Required for scanning with arp-scan, nmap, nbtscan, traceroute, and zero-conf
      - NET_RAW                                     # Required for raw socket operations with arp-scan, nmap, nbtscan, traceroute and zero-conf
      - NET_BIND_SERVICE                            # Required to bind to privileged ports with nbtscan
    #  - CHOWN                                       # Required for root-entrypoint to chown /data + /tmp before dropping privileges
    #  - SETUID                                      # Required for root-entrypoint to switch to non-root user
    #  - SETGID                                      # Required for root-entrypoint to switch to non-root group                  
    volumes:

     # Override the Configuration Template
      - type: bind
        source: /var/lib/containers/config/netalertx/server/nginx/netalertx.conf.template
        target: /services/config/nginx/netalertx.conf.template
        read_only: true

     # Override the Configuration File as it is
     # - type: bind
     #   source: /var/lib/containers/config/netalertx/server/nginx/sites-available/default
     #   target: /etc/nginx/sites-available/default
     #   read_only: true

      - type: bind                                  # Persistent Docker-managed Named Volume for storage
        source: /var/lib/containers/data/netalertx/server
        target: /data                               # consolidated configuration and database storage
        read_only: false                            # writable volume

     # - type: bind                                  # Persistent Docker-managed Named Volume for storage
     #   source: /var/lib/containers/config/netalertx/server
     #   target: /data/config                        # consolidated configuration and database storage
     #   read_only: false                            # writable volume

     # - type: bind                                  # Persistent Docker-managed Named Volume for storage
     #   source: /var/lib/containers/db/netalertx/server
     #   target: /data/db                            # consolidated configuration and database storage
     #   read_only: false                            # writable volume

    # Privileged Container
    # privileged: true

    # Example custom local folder called /home/user/netalertx_data
    # - type: bind
    #   source: /home/user/netalertx_data
    #   target: /data
    #   read_only: false
    # ... or use the alternative format
    # - /home/user/netalertx_data:/data:rw

      - type: bind                           # Bind mount for timezone consistency
        source: /etc/localtime
        target: /etc/localtime
        read_only: true

    # Use a custom Enterprise-configured nginx config for ldap or other settings
    # - /custom-enterprise.conf:/tmp/nginx/active-config/netalertx.conf:ro

    # Test your plugin on the production container
    # - /path/on/host:/app/front/plugins/custom

    # Retain logs - comment out tmpfs /tmp/log if you want to retain logs between container restarts
    # - /path/on/host/log:/tmp/log

    # tmpfs mounts for writable directories in a read-only container and improve system performance
    # All writes now live under /tmp/* subdirectories which are created dynamically by entrypoint.d scripts
    # mode=1700 gives rwx------ permissions; ownership is set by /root-entrypoint.sh
    #tmpfs:
    #  # - "/tmp:mode=1700,uid=0,gid=0,rw,noexec,nosuid,nodev,async,noatime,nodiratime"
    #  - "/tmp:mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"

      - type: tmpfs
        target: /tmp
        tmpfs-mode: 1700
        uid: 0
        gid: 0
        rw: true
        noexec: true
        nosuid: true
        nodev: true
        async: true
        noatime: true
        nodiratime: true

    env_file:
      - .env

    environment:
      PUID: ${NETALERTX_UID:-20211}                             # Runtime UID after priming (Synology/no-copy-up safe)
      PGID: ${NETALERTX_GID:-20211}                             # Runtime GID after priming (Synology/no-copy-up safe)
      LISTEN_ADDR: ${LISTEN_ADDR:-0.0.0.0}                      # Listen for connections on all interfaces
      PORT: ${PORT:-20211}                                      # Application port
      GRAPHQL_PORT: ${GRAPHQL_PORT:-20212}                      # GraphQL API port
      ALWAYS_FRESH_INSTALL: ${ALWAYS_FRESH_INSTALL:-false}      # Set to true to reset your config and database on each container start
      NETALERTX_DEBUG: ${NETALERTX_DEBUG:-0}                    # 0=kill all services and restart if any dies. 1 keeps running dead services.

    # Security Settings
    #security_opt:
    #  - no-new-privileges:true

    # Resource limits to prevent resource exhaustion
    mem_limit: 2048m            # Maximum memory usage
    mem_reservation: 1024m      # Soft memory limit
    cpu_shares: 512             # Relative CPU weight for CPU contention scenarios
    pids_limit: 512             # Limit the number of processes/threads to prevent fork bombs
    logging:
      driver: "json-file"       # Use JSON file logging driver
      options:
        max-size: "10m"         # Rotate log files after they reach 10MB
        max-file: "3"           # Keep a maximum of 3 log files

    # Always restart the container unless explicitly stopped
    restart: unless-stopped