services:
  tailscale:
    image: tailscale/tailscale:stable
    container_name: zerobyte-tailscale
    hostname: ${TS_HOSTNAME:-zerobyte}
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      # Required for Kernel native Tailscale (not userspace mode)
      - SYS_MODULE
    devices:
      - /dev/net/tun:/dev/net/tun
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_STATE_DIR=/var/lib/tailscale
      # Use Kernel native Tailscale (not userspace mode)
      - TS_USERSPACE=false
      # Optional flags passed to `tailscale up`.
      # Examples:
      # - --advertise-tags=tag:zerobyte
      # - --accept-dns=true --accept-routes
      - TS_EXTRA_ARGS=${TS_EXTRA_ARGS:-}
    volumes:
      - tailscale-state:/var/lib/tailscale
    # If you only want access over Tailscale (not from the local network), remove this.
    ports:
      - "4096:4096"

  zerobyte:
    image: ghcr.io/nicotsx/zerobyte:latest
    container_name: zerobyte
    restart: unless-stopped
    # Share the Tailscale network namespace (sidecar pattern)
    network_mode: service:tailscale
    depends_on:
      - tailscale
    devices:
      - /dev/fuse:/dev/fuse
    cap_add:
      - SYS_ADMIN
    environment:
      - TZ=${TZ:-UTC}
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - zerobyte-data:/var/lib/zerobyte

volumes:
  tailscale-state:
  zerobyte-data: