services:
  headscale:
    # 釘版本避免 watchtower 自動套用破壞性更新（見 OPERATIONS.md → 故障排除）。
    # 升級時手動改 tag 並先看 CHANGELOG 的 BREAKING 段落。
    image: headscale/headscale:v0.29.0
    container_name: headscale
    restart: unless-stopped
    networks:
      - shared-net

    # 環境變數
    environment:
      - TZ=Asia/Taipei

    # 健康檢查
    healthcheck:
      test: ["CMD-SHELL", "headscale version >/dev/null 2>&1 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

    # 日誌配置
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

    # 卷掛載
    volumes:
      - ./config:/etc/headscale:ro
      - ./data:/var/lib/headscale
      - /etc/localtime:/etc/localtime:ro

    # 埠位映射
    ports:
      - "8080:8080"    # HTTP API
      - "9090:9090"    # Metrics
      - "50443:50443"  # gRPC

    # 標籤配置
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
      - "description=Headscale WireGuard control plane"

networks:
  shared-net:
    external: true