services:
  env-controller:
    build: .
    container_name: glpi-env-controller
    restart: unless-stopped
    environment:
      ENV_CONTROLLER_CONFIG: /config/controller.json
      HOME: /tmp
    secrets:
      - env_controller_password
    ports:
      - "127.0.0.1:8090:8090"
    volumes:
      - ./controller.json:/config/controller.json:ro
      - ./backups:/backups:rw
      - /var/run/docker.sock:/var/run/docker.sock
      # Die verwalteten Compose-Projekte müssen im Controller unter den
      # Pfaden verfügbar sein, die in controller.json stehen.
      - /opt/glpi-ai-stack:/opt/glpi-ai-stack:rw
      - /opt/glpi-kb-stack:/opt/glpi-kb-stack:rw
    read_only: true
    tmpfs:
      - /tmp:size=32m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8090/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

secrets:
  env_controller_password:
    file: ./controller.password