docker-compose.yml

# Cap container logs so an unattended box can't slowly fill its disk - Docker's
# default json-file driver never rotates. 10 MB x 5 = 50 MB. (Mirrors the rest
# of the Canvas suite.)
x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

services:
  alertcanvas:
    build: .
    image: alertcanvas
    container_name: alertcanvas
    # Outbound syslog stamps the container hostname into its HOSTNAME field -
    # without this it's the random container id (e.g. "a405d785e4af").
    hostname: alertcanvas
    # Default port 9162 ("162" for SNMP traps - fitting for the suite's
    # alerting app). Stays clear of UptimeKuma (3001), CrossCanvas/PingCanvas
    # (8080/8443, also serves the CrossCanvas editor), SNMPCanvas (9161),
    # SyslogCanvas (9514), and LaunchCanvas (9160) on a shared host.
    ports:
      - "9162:9162"
    volumes:
      # Everything persistent lives here ON THE HOST: the SQLite database and
      # TLS certs (data/certs/). Create it writable by the container user:
      #   mkdir -p data && sudo chown 1000:1000 data
      # The :z suffix labels the mount for SELinux hosts (RHEL/Rocky/Fedora);
      # it's a no-op elsewhere.
      - ./data:/data:z
      # The feed: a READ-ONLY view of the directory where SNMPCanvas writes
      # snmp-status.json. AlertCanvas reads /status/snmp-status.json by
      # default (Settings -> status file path). Do NOT edit this line in
      # place - put your real path in docker-compose.override.yml (gitignored,
      # auto-loaded, merged by mount path) so updates pull cleanly:
      #   services:
      #     alertcanvas:
      #       volumes:
      #         - /srv/snmpcanvas/data:/status:ro,z
      - ../snmpcanvas/data:/status:ro,z
    # Make the DOCKER HOST reachable from inside the container by name -
    # for when your SMTP relay or syslog server runs on this same box (as a
    # host service or another container with a published port). Point
    # Settings -> Email/Syslog at "host.docker.internal" instead of a bridge
    # IP that can change. Note the traffic arrives FROM the docker bridge
    # subnet (172.x), so a relay restricted by source network (e.g. Postfix
    # mynetworks) must also allow 172.16.0.0/12.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      # Timezone governs log timestamps
      - TZ=Etc/UTC
      # Optional: pre-set the admin password (otherwise the UI offers a
      # first-run setup page)
      #- ADMIN_PASSWORD=change-me
      # Optional: encrypt the stored SMTP password at rest with this secret
      #- ALERTCANVAS_SECRET=a-long-random-string
      # Optional: read the feed from a different path inside the container
      #- STATUS_FILE=/status/snmp-status.json
    # Run an init (tini) as PID 1 so orphaned processes get reaped. Node does
    # not reap children it did not spawn, and the HEALTHCHECK's wget leaves an
    # ssl_client behind on every HTTPS probe. Those zombies still hold a slot
    # against the nproc limit of the HOST uid the container runs as (1000), so
    # after about a day that user cannot fork anything - including its own SSH
    # sessions, which fail with "Server refused to start a shell/command".
    # Costs nothing: Docker ships the init binary, no image rebuild needed.
    init: true
    logging: *default-logging
    restart: unless-stopped

# HTTPS: run  ./tools/gen-cert.sh <hostname-or-ip>  once on the host (or drop
# your own PEM pair at data/certs/server.crt + server.key), then
# `docker compose restart`. The server switches to HTTPS automatically.