services:
  socket-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: socket-proxy
    restart: unless-stopped
    networks:
      - tan-network
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - SERVICES=1
      - TASKS=1
      - INFO=1
      - PING=1
      - VERSION=1
      - POST=0

  openclaw:
    image: ghcr.io/openclaw/openclaw:latest
    container_name: openclaw
    restart: unless-stopped
    depends_on:
      - socket-proxy
    networks:
      - tan-network
    volumes:
      - /home/docker/openclaw/data:/app/data
      - ./config:/app/config
    environment:
      - TZ=Europe/Paris
      - OPENCLAW_BASE_URL=https://claw.tondomaine.tld
      - DOCKER_HOST=tcp://socket-proxy:2375
    labels:
      - traefik.enable=true
      - traefik.http.routers.openclaw.rule=Host(`claw.tondomaine.tld`)
      - traefik.http.routers.openclaw.entrypoints=websecure
      - traefik.http.routers.openclaw.tls=true
      - traefik.http.routers.openclaw.middlewares=authentik@docker
      - traefik.http.services.openclaw.loadbalancer.server.port=3000

networks:
  tan-network:
    external: true