---
# https://gethomepage.dev/latest/configs/docker/
#
# All four Docker hosts expose the engine on port 2375. This is plaintext
# and works fine on a trusted LAN; if any host is ever exposed or shared,
# switch to a TLS socket (examples commented below).

esh-vm-docker:
  host: 10.0.50.45
  port: 2375

ana-pfi-docker:
  host: 10.250.50.70
  port: 2375

nh3-pfi-docker:
  host: 10.100.50.40
  port: 2375

# ana-ml2-docker DISABLED 2026-09-07: 10.250.50.54:2375 is not reachable from
# esh-docker-vm (docker API not exposed/listening — ana-docker 10.250.50.70:2375
# on the SAME subnet IS reachable, so this is host-specific, not routing). A dead
# host here hangs the entire /api/services aggregation until its TCP connect times
# out. Re-enable once ana-ml2 exposes the docker API and it is reachable from ESH.
# ana-ml2-docker:
#   host: 10.250.50.54
#   port: 2375

# irv-ml1 — moved 10.100.79.3 -> 10.6.110.50 on 2026-09-06 (headscale cutover;
# the old wg0 tunnel IP is dormant and no longer answers). Reachable from
# esh-docker-vm via the mesh (10.6.110.50:2375 verified OPEN 2026-09-07).
irv-ml1-docker:
  host: 10.6.110.50
  port: 2375

# Example TLS socket (if/when a host moves off plaintext 2375):
# ana-pfi-docker:
#   host: 10.250.50.70
#   port: 2376
#   tls:
#     keyFile: docker-tls/ana-docker/key.pem
#     caFile:  docker-tls/ana-docker/ca.pem
#     certFile: docker-tls/ana-docker/cert.pem