docker-compose.yml

---
# MeshCentral - Full web-based remote monitoring and management platform.
# Official image: ghcr.io/ylianst/meshcentral
# Official docs: https://github.com/Ylianst/MeshCentral/tree/master/docker
#
# Image variants:
#   latest             - all database backends
#   latest-slim        - no database (NeDB local only, max ~100 devices)
#   latest-mongodb     - MongoDB backend (used here)
#   latest-postgresql  - PostgreSQL backend
#   latest-mysql       - MariaDB/MySQL backend
#   1.1.59-mongodb     - pinned version example
#
# Ports:
#   443  - HTTPS web UI and agent connections (main port)
#   80   - HTTP redirect to HTTPS
#   4433 - Intel AMT (uncomment only if you manage Intel AMT devices)
#
# Behind Nginx Proxy Manager:
#   - Do NOT expose port 443 to the internet directly.
#   - Map container 443 to a non-standard host port (4430 used here).
#   - Set REVERSE_PROXY and REVERSE_PROXY_TLS_PORT in .env.
#   - Enable WebSocket support in NPM — required for agent connections.
#   - Disable HTTP/2 in NPM — MeshCentral agent protocol is incompatible with it.
#   - Force SSL in NPM.
#
# Volumes:
#   meshcentral-data    - config.json, TLS certs, session keys (CRITICAL — back up)
#   meshcentral-files   - user file uploads and device file transfers
#   meshcentral-web     - custom themes and branding
#   meshcentral-backups - automated MeshCentral backups
#   meshcentral-db      - MongoDB data directory
#
# Security:
#   - MongoDB has no host port exposed. Only reachable on the internal network.
#   - Set ALLOW_NEW_ACCOUNTS=false in .env after creating your admin account.
#   - Never commit .env to a public repository.

services:
  mongodb:
    image: mongo:7.0
    container_name: meshcentral-db
    restart: unless-stopped
    # No host port — MongoDB is only reachable inside meshcentral-net
    expose:
      - "27017"
    volumes:
      - meshcentral-db:/data/db
    environment:
      MONGO_INITDB_ROOT_USERNAME: "${MONGO_USERNAME}"
      MONGO_INITDB_ROOT_PASSWORD: "${MONGO_PASS}"
      MONGO_INITDB_DATABASE: meshcentral
    networks:
      - meshcentral-net
    healthcheck:
      # mongosh replaces the removed mongo CLI in Mongo 6.x+
      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s

  meshcentral:
    image: ghcr.io/ylianst/meshcentral:latest-mongodb
    container_name: meshcentral
    restart: unless-stopped
    depends_on:
      mongodb:
        condition: service_healthy
    ports:
      # 4430 maps to the container's internal 443.
      # In NPM, set Forward Port to 443 (the internal port, not 4430).
      - "4430:443"
      - "8080:80"
      # Intel AMT — uncomment only if you use Intel AMT device management
      # - "4433:4433"
    volumes:
      - meshcentral-data:/opt/meshcentral/meshcentral-data
      - meshcentral-files:/opt/meshcentral/meshcentral-files
      - meshcentral-web:/opt/meshcentral/meshcentral-web
      - meshcentral-backups:/opt/meshcentral/meshcentral-backups
    env_file:
      - .env
    networks:
      - meshcentral-net
      - default
    healthcheck:
      test: ["CMD", "curl", "-k", "--fail", "https://localhost:443/health.ashx"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s

volumes:
  meshcentral-data:
    driver: local
  meshcentral-files:
    driver: local
  meshcentral-web:
    driver: local
  meshcentral-backups:
    driver: local
  meshcentral-db:
    driver: local

networks:
  # Internal network — MongoDB unreachable from outside this stack
  meshcentral-net:
    driver: bridge
    internal: true
  # Shared external network — lets Nginx Proxy Manager reach meshcentral by name
  default:
    name: my-main-net
    external: true