services:
  idock:
    build:
      context: .
      dockerfile: Dockerfile
    image: synapse-idock:1.0.0
    container_name: synapse-idock
    restart: unless-stopped
    ports:
      - "${IDOCK_PORT:-8800}:8000"
    environment:
      # --- Core ---
      IDOCK_DATA_DIR: /data
      # Persisted automatically on first run if left blank; set for multi-replica.
      IDOCK_SECRET_KEY: ${IDOCK_SECRET_KEY:-}
      IDOCK_SESSION_HTTPS_ONLY: ${IDOCK_SESSION_HTTPS_ONLY:-false}
      # Externally-reachable URL for the Deploy Agent command (behind a domain/proxy).
      # Leave blank to auto-detect the host's LAN IP.
      IDOCK_PUBLIC_URL: ${IDOCK_PUBLIC_URL:-}
      # --- Discovery / staging ---
      IDOCK_DISCOVERY_ENABLED: ${IDOCK_DISCOVERY_ENABLED:-true}
      IDOCK_DISCOVERY_INTERVAL: ${IDOCK_DISCOVERY_INTERVAL:-30}
      IDOCK_DISCOVERY_INCLUDE_LOCAL: ${IDOCK_DISCOVERY_INCLUDE_LOCAL:-true}
      # Comma-separated remote Docker API endpoints to probe & stage.
      IDOCK_DISCOVERY_TARGETS: ${IDOCK_DISCOVERY_TARGETS:-}
      IDOCK_BYPASS_LABEL: ${IDOCK_BYPASS_LABEL:-synapse.idock.enabled}
      # --- Agent image delivery ---
      # Leave blank to have iDOCK build & serve the agent image itself (needs the
      # Docker socket below). Set to a registry ref to use `docker pull` instead.
      IDOCK_AGENT_IMAGE: ${IDOCK_AGENT_IMAGE:-}
      IDOCK_AGENT_AUTOBUILD: ${IDOCK_AGENT_AUTOBUILD:-true}
    volumes:
      # Persistent app state: DB, generated secret, uploaded TLS/SSH material.
      - idock_data:/data
      # Read-only mount of the host's Docker socket enables local management.
      # Remove this if you only manage remote hosts over TLS/SSH.
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # Mount SSH keys read-only if you manage hosts over ssh://.
      # - ${HOME}/.ssh:/root/.ssh:ro
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/health').status==200 else 1)"]
      interval: 30s
      timeout: 5s
      retries: 3

volumes:
  idock_data:
    driver: local
