Homedex

# Homedex needs only this file. It pulls the published multi-arch image, so no
# checkout or Go/Node toolchain is required:
#
#   mkdir homedex
#   cd homedex
#   curl -fsSLO https://raw.githubusercontent.com/HarshShah0203/homedex/main/docker-compose.yml
#   docker compose up -d
#
# Use a new, empty directory: the download replaces any docker-compose.yml
# there, and Compose also reads a .env or docker-compose.override.yml beside it.
#
# HOMEDEX_VERSION pins a release (default: the newest 0.2.x). To build from a
# checkout instead, add docker-compose.build.yml:
#   docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build
name: homedex

services:
  docker-socket-proxy:
    image: tecnativa/docker-socket-proxy:v0.4.2
    restart: unless-stopped
    environment:
      CONTAINERS: 1
      IMAGES: 1
      INFO: 1
      NETWORKS: 1
      VERSION: 1
      POST: 0
      ALLOW_START: 0
      ALLOW_STOP: 0
      ALLOW_RESTARTS: 0
    volumes:
      # `:ro` protects the socket file from replacement; POST=0 above is what
      # filters mutating Docker API calls. A raw socket mounted read-only is
      # still a privileged Docker API connection.
      - /var/run/docker.sock:/var/run/docker.sock:ro
    read_only: true
    tmpfs:
      - /run
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    networks:
      - discovery

  homedex:
    image: ghcr.io/harshshah0203/homedex:${HOMEDEX_VERSION:-0.2}
    restart: unless-stopped
    depends_on:
      - docker-socket-proxy
    ports:
      # Loopback by default: until setup completes, whoever reaches the UI first
      # sets the admin password. HOMEDEX_BIND=0.0.0.0 opens it to the LAN; set
      # HOMEDEX_ADMIN_PASSWORD with it so the setup page is never open to others.
      - "${HOMEDEX_BIND:-127.0.0.1}:${HOMEDEX_PORT:-7377}:7377"
    environment:
      HOMEDEX_DATA_DIR: /data
      HOMEDEX_LISTEN: :7377
      # Optional, empty by default (the setup wizard then creates the admin).
      # On a first start with no admin yet, Homedex stores only the Argon2id
      # hash of this password; one shorter than 12 characters stops startup
      # with an error. Once an admin exists the value is ignored and never
      # replaces it, so it can be dropped after the first start. To keep it out
      # of `docker inspect`, set HOMEDEX_ADMIN_PASSWORD_FILE to a mounted secret
      # instead (docs/SECURITY_DEPLOYMENT.md). The value is never logged.
      HOMEDEX_ADMIN_PASSWORD: ${HOMEDEX_ADMIN_PASSWORD:-}
    volumes:
      - homedex-data:/data
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    networks:
      - app
      - discovery

networks:
  app:
    internal: false
  discovery:
    internal: true

volumes:
  homedex-data:

git clone https://github.com/HarshShah0203/homedex
cd homedex
docker compose -f docker-compose.yml up -d