version: "3.7"

services:
  headscale:
    image: "${HEADSCALE_IMAGE:-ghcr.io/juanfont/headscale:0.29.3}"
    container_name: headscale-local
    command: serve
    restart: unless-stopped
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /var/run/headscale:mode=0770,size=1m
    environment:
      HEADSCALE_SERVER_URL: "http://127.0.0.1:8080"
      HEADSCALE_DNS_BASE_DOMAIN: "tail.localhost"
    ports:
      - "127.0.0.1:8080:8080"
      - "127.0.0.1:9090:9090"
    volumes:
      - ./config:/etc/headscale:ro
      - ./data:/var/lib/headscale
    healthcheck:
      test: ["CMD", "headscale", "health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    stop_grace_period: 30s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"