# Beszel — lightweight host + container monitoring, VPS (ROOTLESS PODMAN) edition.
#
# Adapted from the home server's Docker/root version. Differences and why:
#
#   docker.sock -> /run/user/1000/podman/podman.sock
#       Rootless podman's API socket. It exposes ONLY rootless containers, which is
#       exactly the set we want reported. No :Z on the socket mount -- relabeling the
#       live socket breaks podman. See AGENTS.md §6.
#
#   security_opt: label:disable on the agent
#       Required under SELinux Enforcing to read that socket, which systemd recreates
#       each boot as user_tmp_t. Same treatment as portainer/uptime.
#
#   EXTRA_FILESYSTEMS=/boot dropped
#       The home server has /boot on its own 974M partition. This VPS does not --
#       /dev/sda1 is the whole root fs and /boot/efi is a 64M ESP not worth alerting on.
#
#   No hostname/domainname on the agent
#       Host networking forbids them, same as on the home server.
#
# The hub generates its keypair on first start at ./volumes/hub/id_ed25519.pub.
# That public key is what goes in the agent's KEY below.

networks:
  nginx-bridge:
    external: true

services:
  beszel:
    image: docker.io/henrygd/beszel:latest
    container_name: beszel
    hostname: beszel
    domainname: beszel.gibbyb.com
    networks: ['nginx-bridge']
    # No published port: NPM proxies to http://beszel:8090 over nginx-bridge.
    environment:
      - TZ=America/New_York
    # Lets the hub reach a host-network agent. Under rootless podman this resolves to
    # the nginx-bridge gateway (172.18.0.1). Add the VPS in the hub UI with host
    # "host.docker.internal", port 45876.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    volumes:
      - ./volumes/hub:/beszel_data:Z
    tty: true
    stdin_open: true
    restart: unless-stopped

  beszel-agent:
    image: docker.io/henrygd/beszel-agent:latest
    container_name: beszel-agent
    network_mode: host
    environment:
      - TZ=America/New_York
      - PORT=45876
      # This hub's public key. Newer Beszel writes only ./volumes/hub/id_ed25519 (private);
      # derive the public half with:  ssh-keygen -y -f volumes/hub/id_ed25519
      # It is a PUBLIC key -- safe to keep in this file.
      - KEY=ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDBWNqxKGRltqXJZg+wlDOtICeLo19ftQ6P3P8+uJg8y
    security_opt: ['label:disable']
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    volumes:
      - ./volumes/agent:/var/lib/beszel-agent:Z
      - /run/user/1000/podman/podman.sock:/var/run/docker.sock:ro
    tty: true
    stdin_open: true
    restart: unless-stopped