services:
  portainer:
    image: portainer/portainer-ee:latest
    container_name: portainer
    hostname: portainer
    domainname: port.gibbyb.com
    networks:
      - nginx-bridge
    environment:
      - TZ=America/New_York
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    ports:
      # WireGuard address only — this admin UI has no business on the public
      # interface. It has its own login and the Hetzner firewall does not admit this
      # port, so this is defence in depth: it removes the dependency on a firewall rule
      # set that lives in a web console. See AGENTS.md §13.2.
      - 192.168.2.2:9443:9443
    # Required under SELinux Enforcing to reach the rootless podman socket, which
    # systemd recreates at each boot with a non-container label. The socket mount
    # deliberately has no :Z -- relabeling the live socket would break podman itself.
    security_opt: ['label:disable']
    volumes:
      - ./volumes/data:/data:Z
      - /run/user/1000/podman/podman.sock:/var/run/docker.sock
    tty: true
    restart: unless-stopped

networks:
  nginx-bridge:
    external: true