# Home Assistant - Nyílt forráskódú okos otthon központ
# Domain: ${SUBDOMAIN}.${DOMAIN}
# Database: None (file-based)
# RAM: ~256M (mem_limit: 1024M) | Pi-compatible: Yes
#
# Environment variables:
#   DOMAIN          - Your domain (e.g., demo-felhom.eu)

services:
  home-assistant:
    image: ghcr.io/home-assistant/home-assistant:2026.2.2
    container_name: home-assistant
    restart: unless-stopped
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        # Ensure reverse-proxy (Traefik) trusted_proxies config exists.
        # 172.16.0.0/12 covers all Docker bridge networks.
        CFG=/config/configuration.yaml
        if [ -f "$$CFG" ] && ! grep -q 'trusted_proxies' "$$CFG"; then
          printf '\nhttp:\n  use_x_forwarded_for: true\n  trusted_proxies:\n    - 172.16.0.0/12\n' >> "$$CFG"
        elif [ ! -f "$$CFG" ]; then
          cat > "$$CFG" << 'HACFG'
        default_config:
        frontend:
          themes: !include_dir_merge_named themes
        automation: !include automations.yaml
        script: !include scripts.yaml
        scene: !include scenes.yaml
        http:
          use_x_forwarded_for: true
          trusted_proxies:
            - 172.16.0.0/12
        HACFG
        fi
        exec /init
    environment:
      - TZ=Europe/Budapest
    volumes:
      - homeassistant_config:/config
    networks:
      - traefik-public
    deploy:
      resources:
        limits:
          memory: 1024M
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8123/manifest.json"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.home-assistant.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.home-assistant.entrypoints=websecure"
      - "traefik.http.routers.home-assistant.tls=true"
      - "traefik.http.routers.home-assistant.tls.certresolver=letsencrypt"
      - "traefik.http.services.home-assistant.loadbalancer.server.port=8123"

volumes:
  homeassistant_config:

networks:
  traefik-public:
    external: true