services:
  jbod-monitor:
    build: .
    image: docker.adamksmith.xyz/jbod-monitor:latest
    container_name: jbod-monitor
    restart: unless-stopped
    privileged: true
    pid: host
    network_mode: host
    volumes:
      - /dev:/dev
      - /sys:/sys:ro
      - /run/udev:/run/udev:ro
      # OpenBao RO token (claude-read) mounted read-only; never bake into image.
      - /etc/jbod-monitor/openbao-token:/run/secrets/openbao-token:ro
    environment:
      - TZ=America/Denver
      - UVICORN_LOG_LEVEL=info
      - ZFS_USE_NSENTER=true
      - REDIS_HOST=127.0.0.1
      - REDIS_PORT=6379
      - REDIS_DB=0
      - SMART_CACHE_TTL=120
      - SMART_POLL_INTERVAL=90
      # Home Assistant MQTT publishing (opt-in: leave MQTT_HOST unset to disable).
      # EMQX at 10.5.30.3 is reachable by IP and bridged to the Mosquitto HA
      # add-on, so discovery reaches Home Assistant either way.
      - MQTT_HOST=10.5.30.3
      - MQTT_PORT=1883
      - MQTT_DISCOVERY_PREFIX=homeassistant
      - MQTT_BASE_TOPIC=jbod-monitor
      - MQTT_PUBLISH_INTERVAL=60
      # Broker credentials sourced from OpenBao (secret/home_assistant,
      # keys: mqtt_user/mqtt_pass). Falls back to MQTT_USERNAME/MQTT_PASSWORD
      # env if the read fails. Token is the read-only claude-read token.
      - OPENBAO_ADDR=https://vault.adamksmith.xyz
      - OPENBAO_TOKEN_FILE=/run/secrets/openbao-token
      - MQTT_SECRET_PATH=home_assistant
      - MQTT_SECRET_USER_KEY=mqtt_user
      - MQTT_SECRET_PASS_KEY=mqtt_pass
    depends_on:
      - redis

  redis:
    image: redis:7-alpine
    container_name: jbod-redis
    restart: unless-stopped
    network_mode: host
    volumes:
      - redis-data:/data
    command: redis-server --save 60 1 --loglevel warning

volumes:
  redis-data: