services:
  wlc-monitor:
    build: .
    image: git.snakedesert.se/lundberg/wlc-monitor:latest
    container_name: wlc-monitor
    restart: unless-stopped

    # Credentials come from .env (gitignored, chmod 600), never from the image.
    env_file: [.env]

    environment:
      MONITOR_STATE_FILE: /data/state.json
      # Timestamps in alert bodies use the container's zone; without this they
      # render as UTC and will not match the controller's log timestamps.
      TZ: ${TZ:-UTC}

    volumes:
      # Named volume: alert de-duplication and the consecutive-failure counter
      # live here. Lose it and the container re-alerts from a blank slate.
      - wlc-monitor-state:/data

    # Read-only rootfs; the only thing that needs writing is /data.
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    logging:
      driver: json-file
      options: {max-size: "10m", max-file: "3"}

volumes:
  wlc-monitor-state: