services:
  socket-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: ${PROXY_NAME}
    restart: unless-stopped
    environment:
      # These flags allow only the actions Dockhand needs
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - VOLUMES=1
      - INFO=1
      # Disable anything not strictly necessary
      - POST=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  dockhand:
    image: fnsys/dockhand:latest
    container_name: ${DOCKHAND_NAME}
    restart: unless-stopped
    ports:
      - 3200:3000
    volumes:
      - ${DOCKER_BASE_PATH}/dockhand:/app/data
      - ${DOCKER_BASE_PATH}/dockhand/stack:/stack
      - ${DOCKER_BASE_PATH}:/DockerConfigs
    environment:
      # Point Dockhand to the proxy instead of the local socket file
      - DOCKER_HOST=tcp://socket-proxy:2375
      - ADMIN_USERNAME=${ADMIN_USERNAME}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
      - TZ=UTC
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
          - management-net
    depends_on:
          - socket-proxy
networks:
  management-net:
    driver: bridge