version: '3.8'

services:
  pulse:
    image: ${PULSE_IMAGE:-rcourtman/pulse:latest}
    container_name: pulse
    restart: unless-stopped
    ports:
      - "${PULSE_PORT:-7655}:7655"
    volumes:
      - pulse-data:/data
      # Secure temperature monitoring via host-side proxy (requires setup - see docs)
      # Uncomment after installing pulse-sensor-proxy on host with --standalone flag
      # Mount is read-only (:ro) for security - proxy uses SO_PEERCRED for access control
      # - /run/pulse-sensor-proxy:/run/pulse-sensor-proxy:ro
    environment:
      - TZ=${TZ:-UTC}
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:7655/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

volumes:
  pulse-data:
    driver: local