services:
  meterbox:
    build: .
    container_name: meterbox
    restart: unless-stopped
    # Host network + bind 127.0.0.1 inside the app:
    # - accurate host NIC / load metrics
    # - no Docker published ports (avoids DNAT bypass of INPUT REJECT)
    # - Caddy/Rathole can still reach 127.0.0.1:8787
    network_mode: host
    pid: host
    volumes:
      - ./data:/app/data
      - /etc/os-release:/etc/os-release:ro
      - /etc/hostname:/etc/hostname:ro
      - /run/bwflow:/run/bwflow:ro
      - /var/lib/vnstat:/var/lib/vnstat:ro
      - /etc/vnstat.conf:/etc/vnstat.conf:ro
    environment:
      METERBOX_LISTEN: "127.0.0.1:8787"
      METERBOX_DB: "/app/data/meterbox.db"
      METERBOX_STATIC: "/app/frontend/dist"
      METERBOX_INTERVAL_SECS: "30"
      METERBOX_RETENTION_DAYS: "90"
      # Hard cap: 10 GiB for SQLite (db + wal + shm). Cleanup job trims oldest rows.
      METERBOX_MAX_DB_BYTES: "10737418240"
      METERBOX_CLEANUP_INTERVAL_SECS: "3600"
      METERBOX_BWFLOW_SOCK: "/run/bwflow/bwflow.sock"
    security_opt:
      - no-new-privileges:true