# ============================================
# Arcane — TrueNAS Compose Draft
# ============================================
# Target: TrueNAS regular Docker / Portainer Compose deployment.
# Source pattern:
# - TrueNAS Docker data root: /mnt/HomeStorage02/Docker/<ContainerName>/...
# - Container user convention: PUID=568 / PGID=568 where supported.
#
# Deploy after review:
#   docker compose --env-file arcane-truenas.env -f arcane-truenas-compose.yml up -d
#
# Validate:
#   docker compose --env-file arcane-truenas.env.example -f arcane-truenas-compose.yml config
#
# Notes:
# - Arcane needs access to /var/run/docker.sock to manage the local Docker host.
# - Keep ENCRYPTION_KEY and JWT_SECRET runtime-only; generate them on TrueNAS.
# - Keep the Docker socket exposure LAN/VPN-only; do not expose this UI publicly.
# - ARCANE_PROJECTS_DIRECTORY is bind-mounted at the same host/container path so
#   Arcane-created Compose projects resolve correctly on the Docker host.
# ============================================

services:
  arcane:
    image: ${ARCANE_IMAGE:-ghcr.io/getarcaneapp/manager}:${ARCANE_TAG:-latest}
    container_name: arcane
    restart: unless-stopped
    init: true
    ports:
      - "${ARCANE_HTTP_PORT:-3552}:3552"
    environment:
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:?set ENCRYPTION_KEY in arcane-truenas.env}
      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in arcane-truenas.env}
      PROJECTS_DIRECTORY: ${ARCANE_PROJECTS_DIRECTORY:-/mnt/HomeStorage02/Docker/Arcane/projects}
      TZ: ${TZ:-America/Chicago}
      PUID: ${PUID:-568}
      PGID: ${PGID:-568}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${TRUENAS_DOCKER_ROOT:-/mnt/HomeStorage02/Docker}/Arcane/data:/app/data
      - ${ARCANE_PROJECTS_DIRECTORY:-/mnt/HomeStorage02/Docker/Arcane/projects}:${ARCANE_PROJECTS_DIRECTORY:-/mnt/HomeStorage02/Docker/Arcane/projects}
      - ${TRUENAS_DOCKER_ROOT:-/mnt/HomeStorage02/Docker}/Arcane/builds:/builds
    cgroup: host
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "./arcane", "health", "--timeout", "2s"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 15s