services:
  dockhand:
    image: fnsys/dockhand@sha256:546e7ab26146a64fe93f5f421d3f73914f495a84bfdb87bc3ff3a199388f44a2
    container_name: dockhand
    restart: unless-stopped
    environment:
      - ENCRYPTION_KEY_PATH=/run/secrets/encryption_key
      - DISABLE_LOCAL_LOGIN=true
    networks:
      - homelab_apps
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - dockhand_data:/app/data
    secrets:
      - encryption_key
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=homelab_apps"
      - "traefik.http.routers.dockhand.rule=Host(`${DOCKHAND_DOMAIN}`)"
      - "traefik.http.routers.dockhand.entrypoints=websecure"
      - "traefik.http.routers.dockhand.tls=true"
      - "traefik.http.routers.dockhand.tls.certresolver=le"
      - "traefik.http.services.dockhand.loadbalancer.server.port=3000"

volumes:
  dockhand_data:
    driver: local

networks:
  homelab_apps:
    external: true

secrets:
  encryption_key:
    environment: ENCRYPTION_KEY