docker-compose.yml

# OverwatcherPI — full stack compose
# See docs/docker.md for pre-flight and migration steps.
services:

  bot:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: overwatcher-bot
    network_mode: host          # required: nmap ARP discovery + BlueZ D-Bus
    security_opt:
      - apparmor:unconfined
    cap_add:
      - NET_RAW
      - NET_ADMIN
    group_add:
      - "986"
    env_file: .env
    volumes:
      - ./data:/app/data
      - ./logs:/app/logs
      - /var/run/dbus:/var/run/dbus  # BlueZ D-Bus passthrough (see docs/docker.md)
      - /usr/bin/vcgencmd:/usr/bin/vcgencmd:ro  # Pi throttling/temp queries
      - /var/log/auth.log:/var/log/auth.log:ro  # SSH watcher
      - /var/run/docker.sock:/var/run/docker.sock:ro  # docker socket for container health checks
    devices:
      - /dev/vcio:/dev/vcio  # required by vcgencmd
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "healthcheck.py"]
      interval: 5m
      timeout: 20s
      retries: 3
      start_period: 2m

  dashboard:
    build:
      context: .
      dockerfile: dashboard/Dockerfile
    container_name: overwatcher-dashboard
    # No ports: — intentionally not published to host.
    # Caddy reaches it via the internal network only.
    env_file: .env
    volumes:
      - ./data:/app/data
      - ./logs:/app/logs
    # Exposed to localhost only so Caddy on host network can reach it
    ports:
      - "127.0.0.1:8501:8501"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8501/_stcore/health"]
      interval: 1m
      timeout: 5s
      retries: 3
      start_period: 30s

  caddy:
    image: caddy:2-alpine
    container_name: overwatcher-caddy
    network_mode: host
    volumes:
      - ./dashboard/Caddyfile:/etc/caddy/Caddyfile:ro
    depends_on:
      - dashboard
    restart: unless-stopped