services:
  app:
    image: lerkolabs/uptop:latest
    container_name: uptop
    restart: unless-stopped
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    sysctls:
      - net.ipv4.ping_group_range=0 2147483647
    tmpfs:
      - /tmp
    ports:
      - "23234:23234"
      - "8080:8080"
    environment:
      - UPTOP_DB_TYPE=sqlite
      - UPTOP_DB_DSN=/data/uptop.db
      - UPTOP_HTTP_PORT=8080
      - UPTOP_STATUS_ENABLED=true
      - UPTOP_STATUS_TITLE=System Status
      # SSH access: add your public key via env var or authorized_keys file
      # - UPTOP_ADMIN_KEY=ssh-ed25519 AAAA... you@host
    volumes:
      - ./data:/data
