version: '3.8'

services:
  finger:
    build: .
    # IMPORTANT: host networking is what lets the daemon's abuse protection
    # work. Under Docker's default bridge networking every external client is
    # SNAT'd to the bridge gateway (a 172.16/12 address), so the daemon sees a
    # single source IP for everyone -- the per-IP ban logic can't tell clients
    # apart and (by design) treats that private address as untrackable, leaving
    # banning inert. Host networking exposes the real client IP, so repeat
    # offenders actually get blocked. (Non-root bind of port 79 still works:
    # Docker grants CAP_NET_BIND_SERVICE by default.)
    network_mode: host
    volumes:
      - ./users:/var/finger/users
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "nc -w 1 127.0.0.1 79 < /dev/null || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Bridge-networking alternative (quick local testing only). NOTE: with this
  # mode the daemon only ever sees the bridge gateway IP, so abuse protection
  # is effectively disabled. Prefer host networking above for any public-facing
  # deployment.
  # finger:
  #   image: ghcr.io/waffle2k/finger:latest
  #   ports:
  #     - "79:79"
  #   volumes:
  #     - ./users:/var/finger/users
  #   restart: unless-stopped