docker-compose.yml

# Example docker-compose.yml for local testing and development

services:
  nut-cgi:
    # This file is a local testing example, so it tracks :latest.
    # For production, pin an exact released version instead -- see the
    # "Version Pinning" section of README.md. Renovate ignores this file
    # (see ignorePaths in .github/renovate.json), so a digest pinned here
    # would never be refreshed.
    image: ghcr.io/owine/nut-cgi:latest

    # Run as non-root user (UID 1000 by default)
    user: "1000:1000"

    # Security: Read-only root filesystem
    read_only: true

    # Security: Prevent privilege escalation
    security_opt:
      - no-new-privileges:true

    # Security: Drop all Linux capabilities
    cap_drop:
      - ALL

    # Security: Writable temp space for PIDs and logs
    tmpfs:
      - /tmp

    # Environment variables
    environment:
      # Health check mode: 'basic' (default) or 'strict'
      # basic  = Validate infrastructure only (web server + CGI)
      # strict = Validate infrastructure + UPS connectivity
      - HEALTHCHECK_MODE=basic
      # WARNING: upsset.cgi allows UPS configuration changes (shutdown, etc.)
      # Only enable behind an authenticated reverse proxy.
      # - ENABLE_UPSSET=true
      #
      # Content-Security-Policy. Defaults to a strict policy suited to the stock
      # interface. Override when something downstream injects into the page --
      # e.g. Cloudflare Web Analytics adds its beacon at the edge, after the
      # response has left this container. Replaces the header wholesale, so
      # restate the directives you want to keep. CSP_POLICY=none omits the
      # header entirely (let a reverse proxy own the policy).
      # - CSP_POLICY: "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' https://static.cloudflareinsights.com; connect-src 'self' https://cloudflareinsights.com"

    # Mount your hosts.conf configuration
    volumes:
      - ./hosts.conf:/etc/nut/hosts.conf:ro

    # NOTE: Exposes plain HTTP. In production, deploy behind a reverse proxy
    # (e.g., Traefik, nginx) that provides TLS termination and authentication.
    ports:
      - "8000:80"

    # Restart policy
    restart: unless-stopped