services:
  unifi-os-server:
    image: ghcr.io/lemker/unifi-os-server:latest
    container_name: unifi-os-server
    restart: unless-stopped
    cgroup: host
    cap_add:
      - NET_RAW
      - NET_ADMIN
    extra_hosts:
      host.docker.internal: host-gateway
    tmpfs:
      - /run:exec
      - /run/lock
      - /tmp:exec
      - /var/lib/journal
      - /var/opt/unifi/tmp:size=64m
    environment:
      - UOS_SYSTEM_IP=192.168.86.100
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
      # /persistent on NAS (config backups, survives reinstall)
      - /mnt/docker-data/configs/unifi-os/persistent:/persistent
      # All other dirs local — NFS root_squash blocks the chown calls these services need
      - /var/lib/unifi-os/var-log:/var/log
      - /var/lib/unifi-os/data:/data
      - /var/lib/unifi-os/srv:/srv
      - /var/lib/unifi-os/var-lib-unifi:/var/lib/unifi
      - /var/lib/unifi-os/var-lib-mongodb:/var/lib/mongodb
      - /var/lib/unifi-os/etc-rabbitmq-ssl:/etc/rabbitmq/ssl
    ports:
      - "11443:443"
      - "8080:8080"
      - "3478:3478/udp"
      - "10003:10003/udp"
      - "6789:6789"
      - "8444:8444"
      - "8880:8880"
      - "8881:8881"
      - "8882:8882"
      - "5671:5671"
      - "5514:5514/udp"
      - "9543:9543"
      - "5005:5005"
      - "127.0.0.1:11084:11084"
    labels:
      - "com.centurylinklabs.watchtower.enable=false"
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "3"