# Beszel — lightweight server/container monitoring.
#
# Hub: single web UI with the SQLite store. Agents: per-host metric collectors
# that the hub pulls from over SSH.
#
# Multi-host layout via compose profiles:
#   COMPOSE_PROFILES=hub          → hub only        (ana-docker)
#   COMPOSE_PROFILES=hub,agent    → hub + local agent on the same host
#   COMPOSE_PROFILES=agent        → agent only      (ana-ml2, nh3-docker,
#                                                    esh-docker-vm, vm-esh-nas)
#
# The agent uses network_mode: host so it sees real host CPU/mem/net/disk
# counters rather than container-scoped ones — that's why it can't share
# the tnet network with the hub.
#
# All tunables live in .env — edit that, not this file.

services:
  beszel:
    image: henrygd/beszel:${BESZEL_VERSION}
    container_name: beszel
    profiles: [hub]
    restart: unless-stopped
    ports:
      - "${BESZEL_PORT}:8090"
    volumes:
      - beszel_data:/beszel_data
    healthcheck:
      # Hub image is distroless — no wget/curl. Use the bundled `/beszel`
      # binary's built-in health subcommand (https://beszel.dev/guide/healthchecks).
      test: ["CMD", "/beszel", "health", "--url", "http://localhost:8090"]
      interval: 120s
      timeout: 10s
      retries: 3
      start_period: 15s
    networks:
      - tnet
    labels:
      - homepage.group=Monitoring
      - homepage.name=Beszel
      - homepage.icon=mdi-chart-line
      - homepage.description=Server + container monitoring
      - homepage.href=http://10.250.50.70:${BESZEL_PORT}

  beszel-agent:
    image: henrygd/beszel-agent:${BESZEL_VERSION}
    container_name: beszel-agent
    profiles: [agent]
    restart: unless-stopped
    network_mode: host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - beszel_agent_data:/var/lib/beszel-agent
    environment:
      # Agent auth has two modes (v0.13+ supports both side-by-side):
      #   - KEY-mode: agent listens, hub connects inbound over SSH using KEY.
      #     Requires BESZEL_HUB_KEY in .env.
      #   - Token-mode: agent initiates an outbound connection to HUB_URL
      #     using TOKEN. Easier through NAT. Requires HUB_URL + BESZEL_TOKEN.
      # Leave unused ones empty ("") in .env; both can be set simultaneously.
      - PORT=${BESZEL_AGENT_PORT:-45876}
      - KEY=${BESZEL_HUB_KEY:-}
      - HUB_URL=${HUB_URL:-}
      - TOKEN=${BESZEL_TOKEN:-}
      - EXTRA_FILESYSTEMS=${BESZEL_EXTRA_FS:-}
    healthcheck:
      # Agent image ships the `/agent` binary with a `health` subcommand.
      # Verifies the agent process is up — not that the hub can reach it.
      test: ["CMD", "/agent", "health"]
      interval: 120s
      timeout: 10s
      retries: 3
      start_period: 15s

volumes:
  beszel_data:
  beszel_agent_data:

networks:
  tnet:
    name: traefik-net
    external: true