# SPDX-FileCopyrightText: 2026 Echolot contributors
# SPDX-License-Identifier: GPL-3.0-or-later
#
# Reference deployment. host networking is REQUIRED, not an optimization:
# behind Docker's NAT the observed source address, port-rebinding evidence and
# TTLs — the things the probe protocol measures — would be the proxy's, not
# the client's. With network_mode: host the ECHOLOT_*_LISTEN vars bind real
# host ports; pick free ones.
services:
  echolot-server:
    image: git.rambossek.at/echolot/echolot-server:latest
    container_name: echolot-server
    network_mode: host
    restart: unless-stopped
    environment:
      ECHOLOT_NAME: homelab
      ECHOLOT_CONTROL_LISTEN: ":8443"
      ECHOLOT_UDP_LISTEN: ":8442"
      ECHOLOT_TCP_LISTEN: ":8441"
      # Admin stays loopback-only; reach it via SSH tunnel from the LAN host.
      ECHOLOT_ADMIN_LISTEN: "127.0.0.1:8444"
      # ECHOLOT_TLS_CERT / ECHOLOT_TLS_KEY: omit to self-sign into /state
      #   (clients pin the SPKI — self-signed is first-class).
    volumes:
      - echolot-state:/state

volumes:
  echolot-state: