networks:
  nginx-bridge:
    external: true
services:
  uptime:
    image: louislam/uptime-kuma:latest
    container_name: uptime
    hostname: uptime
    domainname: uptime.gbrown.org
    networks: [nginx-bridge]
    environment:
      - TZ=America/New_York
    volumes:
      - ./volume:/app/data:Z
      - /run/user/1000/podman/podman.sock:/var/run/docker.sock
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    security_opt: ['seccomp:unconfined','label:disable']
      # WireGuard address only — this admin UI has no business on the public
      # interface. It has its own login and the Hetzner firewall does not admit this
      # port, so this is defence in depth: it removes the dependency on a firewall rule
      # set that lives in a web console. See AGENTS.md §13.2.
    ports: ['192.168.2.2:3001:3001']
    tty: true
    stdin_open: true
    restart: unless-stopped