# dockmv, running on the SOURCE host.
#
#   docker compose up -d
#   docker compose logs dockmv   # the URL is printed here
#
# The container needs the Docker socket to read containers and stream their
# data. That is equivalent to root on this host, so the UI is protected by a
# login (created on first visit) and should not be published to an untrusted
# network.

services:
  dockmv:
    image: git.azuze.fr/kawa/dockmv:${VERSION:-latest}
    container_name: dockmv
    restart: unless-stopped
    ports:
      # Bind to loopback only. Use an SSH tunnel to reach it from elsewhere:
      #   ssh -L 8080:127.0.0.1:8080 you@this-host
      - "127.0.0.1:8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      # Accounts, connections, trusted SSH host keys and built packages.
      - migrate-data:/data
    environment:
      TZ: ${TZ:-UTC}
      # dockmv listens on 0.0.0.0 *inside* the container so the ports: mapping
      # above can reach it; that mapping (127.0.0.1 on the host side) is the
      # actual loopback restriction, not this bind address. This tells dockmv
      # not to second-guess that and refuse to start before setup is done.
      DOCKMV_TRUST_ADDR: "1"
    command:
      - serve
      - --addr=0.0.0.0:8080

volumes:
  migrate-data: