Prepare project for public release

docker-compose.yml

@@ -0,0 +1,36 @@
+services:
+  wlc-monitor:
+    build: .
+    image: wlc-monitor:latest
+    container_name: wlc-monitor
+    restart: unless-stopped
+
+    # Credentials come from .env (gitignored, chmod 600), never from the image.
+    env_file: [.env]
+
+    environment:
+      MONITOR_STATE_FILE: /data/state.json
+      # Timestamps in alert bodies use the container's zone; without this they
+      # render as UTC and will not match the controller's log timestamps.
+      TZ: ${TZ:-UTC}
+
+    volumes:
+      # Named volume: alert de-duplication and the consecutive-failure counter
+      # live here. Lose it and the container re-alerts from a blank slate.
+      - wlc-monitor-state:/data
+
+    # Read-only rootfs; the only thing that needs writing is /data.
+    read_only: true
+    tmpfs:
+      - /tmp
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+    logging:
+      driver: json-file
+      options: {max-size: "10m", max-file: "3"}
+
+volumes:
+  wlc-monitor-state: