docker-compose.yml

services:
  unraid-monitor-bot:
    build:
      context: .
      args:
        # DOCKER_GID must match docker.sock group on host for non-root access
        # Default 281 works for Unraid. For other systems:
        # 1. Find your GID: ls -ln /var/run/docker.sock (4th column)
        # 2. Set DOCKER_GID in .env or export before building
        # 3. Rebuild: docker-compose build --no-cache
        DOCKER_GID: ${DOCKER_GID:-281}
    container_name: unraid-monitor-bot
    restart: unless-stopped
    environment:
      - PUID=${PUID:-99}
      - PGID=${PGID:-100}
      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
      - TELEGRAM_ALLOWED_USERS=${TELEGRAM_ALLOWED_USERS}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - OLLAMA_HOST=${OLLAMA_HOST:-}
      - DEFAULT_MODEL=${DEFAULT_MODEL:-}
      - UNRAID_API_KEY=${UNRAID_API_KEY:-}
      - TZ=Europe/London
    volumes:
      # SECURITY NOTE: Docker socket grants root-equivalent access to the host.
      # The :ro flag only prevents deletion of the socket file, not API access.
      # For hardened setups, consider using tecnativa/docker-socket-proxy to
      # restrict exposed Docker API endpoints.
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # For development, use local directories:
      # - ./config:/app/config:ro
      # - ./data:/app/data
      # For production on Unraid, use bind mounts:
      - /mnt/user/appdata/unraid-monitor/config:/app/config
      - /mnt/user/appdata/unraid-monitor/data:/app/data
    networks:
      - docknet

networks:
  docknet:
    external: true