services:
  panel:
    container_name: dsh-mgr-panel
    build: .
    image: dsh-mgr:local
    restart: unless-stopped
    stop_grace_period: 20s
    user: "1000:1000"
    group_add:
      - ${DOCKER_GID:?Set the numeric group ID of the Docker socket}
    ports:
      - '127.0.0.1:8088:8088'
    environment:
      LISTEN_ADDR: 0.0.0.0:8088
      DATA_ROOT: /data
      CONTAINER_DATA_ROOT: /data
      HOST_DATA_ROOT: ${DSH_HOST_DATA_ROOT:?Set an absolute host data directory}
      PANEL_PUBLIC_URL: ${PANEL_PUBLIC_URL:-http://127.0.0.1:8088}
      TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-}
      DSH_RELEASE_REPOSITORY: ${DSH_RELEASE_REPOSITORY:-https://git.misaka.ren/m1saka/dsh-web.git}
      DSH_RELEASE_BRANCH: ${DSH_RELEASE_BRANCH:-dockerfile}
      WEB_DIR: /app/web/dist
      UPLOAD_ALLOWED_EXTENSIONS: ${UPLOAD_ALLOWED_EXTENSIONS:-}
      ADMIN_USERNAME: ${DSH_ADMIN_USERNAME:-admin}
      # Read only on first startup while the user table is empty; remove the
      # value from .env afterwards so the plaintext password is not retained.
      ADMIN_PASSWORD: ${DSH_ADMIN_PASSWORD:-}
      DOCKER_HOST: unix:///var/run/docker.sock
      DSH_DOCKER_ROOT_VISIBLE: ${DSH_DOCKER_ROOT_DIR:?Set the exact DockerRootDir reported by docker info}
      PANEL_CONTAINER_ID: dsh-mgr-panel
    volumes:
      - ${DSH_HOST_DATA_ROOT}:/data
      - /var/run/docker.sock:/var/run/docker.sock
      - ${DSH_DOCKER_ROOT_DIR}:${DSH_DOCKER_ROOT_DIR}:ro
    read_only: true
    tmpfs:
      - /tmp:size=256m
    mem_limit: 1g
    cpus: 2
    pids_limit: 512
    healthcheck:
      test: ["CMD", "/usr/local/bin/dsh-mgr", "-healthcheck"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: '3'