docker-compose.yml

# mc-webui v2 — single container with direct device access
services:
  mc-webui:
    build: .
    container_name: mc-webui
    restart: unless-stopped
    # MC_BIND_ADDRESS=127.0.0.1 keeps the plain-HTTP port off the network once
    # HTTPS is up (docs/https-setup.md). Default 0.0.0.0 = reachable as before.
    ports:
      - "${MC_BIND_ADDRESS:-0.0.0.0}:${FLASK_PORT:-5000}:${FLASK_PORT:-5000}"
    # Grant access to serial devices for auto-detection
    # Major 188 = ttyUSB (CP2102, CH340), Major 166 = ttyACM (ESP32-S3)
    device_cgroup_rules:
      - 'c 188:* rmw'
      - 'c 166:* rmw'
    # NET_ADMIN + NET_RAW for BLE scanning (no overhead when BLE unused)
    cap_add:
      - NET_ADMIN
      - NET_RAW
    volumes:
      - "${MC_CONFIG_DIR:-./data}:/data:rw"
      - "/dev:/dev"
      - "/var/run/dbus:/var/run/dbus"  # BlueZ D-Bus (for BLE)
    environment:
      - MC_SERIAL_PORT=${MC_SERIAL_PORT:-auto}
      - MC_DEVICE_NAME=${MC_DEVICE_NAME:-MeshCore}
      - MC_CONFIG_DIR=/data
      - MC_TCP_HOST=${MC_TCP_HOST:-}
      - MC_TCP_PORT=${MC_TCP_PORT:-5555}
      - MC_BLE_ADDRESS=${MC_BLE_ADDRESS:-}
      - MC_BACKUP_ENABLED=${MC_BACKUP_ENABLED:-true}
      - MC_BACKUP_HOUR=${MC_BACKUP_HOUR:-2}
      - MC_BACKUP_RETENTION_DAYS=${MC_BACKUP_RETENTION_DAYS:-7}
      - FLASK_HOST=${FLASK_HOST:-0.0.0.0}
      - FLASK_PORT=${FLASK_PORT:-5000}
      - FLASK_DEBUG=${FLASK_DEBUG:-false}
      - MC_TRUST_PROXY=${MC_TRUST_PROXY:-false}
      - TZ=${TZ:-UTC}
    env_file:
      - path: .env
        required: false
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  # Optional HTTPS front end — Nginx Proxy Manager.
  # Inert unless the "https" profile is active, so existing installs are untouched.
  # Enable it by putting COMPOSE_PROFILES=https in .env, then run the usual
  # `docker compose up -d --build` (or mcupdate). Full guide: docs/https-setup.md
  #
  # Both services share this project's default network, so the proxy reaches the
  # app at http://mc-webui:5000 without the app publishing any port at all.
  npm:
    image: ${NPM_IMAGE:-jc21/nginx-proxy-manager:latest}
    container_name: mc-webui-proxy
    profiles: ["https"]
    restart: unless-stopped
    depends_on:
      - mc-webui
    ports:
      - "${NPM_HTTP_PORT:-80}:80"     # HTTP — also the Let's Encrypt HTTP-01 challenge
      - "${NPM_HTTPS_PORT:-443}:443"  # HTTPS
      - "${NPM_ADMIN_PORT:-81}:81"    # Proxy Manager admin UI
    volumes:
      - "${NPM_DATA_DIR:-./data/npm}:/data"
      - "${NPM_LETSENCRYPT_DIR:-./data/letsencrypt}:/etc/letsencrypt"
    environment:
      - TZ=${TZ:-UTC}
      - DISABLE_IPV6=${NPM_DISABLE_IPV6:-true}