docker-compose.yml

# Cap container logs so an unattended box can't slowly fill its disk - Docker's
# default json-file driver never rotates. Doubly apt for a log receiver whose
# stdout grows with syslog/trap volume. 10 MB x 5 = 50 MB. (Mirrors PingCanvas.)
x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

services:
  syslogcanvas:
    build: .
    image: syslogcanvas
    container_name: syslogcanvas
    # Default web port 9514 ("514" for syslog) - stays clear of UptimeKuma
    # (3001) and the suite's neighbors: PingCanvas (serves the CrossCanvas
    # editor too) 8080/8443, SNMPCanvas 9161, AlertCanvas 9162, LaunchCanvas
    # 9160 - on a
    # shared docker host.
    ports:
      - "9514:9514"        # web UI (HTTP, or HTTPS once a cert exists)
      # Devices send to the standard ports on the host; inside the container
      # the listeners bind unprivileged 5514/5162 so the process can run as
      # the non-root "node" user.
      - "514:5514/udp"     # syslog
      - "162:5162/udp"     # SNMP traps (v1 + v2c)
    volumes:
      # Everything persistent lives here ON THE HOST: the SQLite database and
      # TLS certs (data/certs/). Create it writable by the container user
      # (and not world-readable - it holds your full message history) first:
      #   mkdir -p data && sudo chown 1000:1000 data && sudo chmod 750 data
      # The :z suffix labels the mount for SELinux hosts (RHEL/Rocky/Fedora);
      # it's a no-op elsewhere.
      - ./data:/data:z
    environment:
      # Timezone governs the nightly prune schedule and log timestamps
      - TZ=Etc/UTC
      # Optional: pre-set the admin password (otherwise the UI offers a
      # first-run setup page)
      #- ADMIN_PASSWORD=change-me
    # Run an init (tini) as PID 1 so orphaned processes get reaped. Node does
    # not reap children it did not spawn, and the HEALTHCHECK's wget leaves an
    # ssl_client behind on every HTTPS probe. Those zombies still hold a slot
    # against the nproc limit of the HOST uid the container runs as (1000), so
    # after about a day that user cannot fork anything - including its own SSH
    # sessions, which fail with "Server refused to start a shell/command".
    # Costs nothing: Docker ships the init binary, no image rebuild needed.
    init: true
    logging: *default-logging
    restart: unless-stopped

# HTTPS: run  ./tools/gen-cert.sh <hostname-or-ip>  once on the host (or drop
# your own PEM pair at data/certs/server.crt + server.key), then
# `docker compose restart`. The server switches to HTTPS automatically.