# portainer — container management UI (operator console)
# Networks: mgmt
#
# Standalone deploy publishes 9443 directly so you have a GUI from day 1,
# before nginx-proxy + TLS are wired up. Once nginx-proxy is up, comment
# the `ports:` block and access via https://portainer.wbd-rd.nl/.

services:
  portainer:
    image: portainer/portainer-ce:2.21.4
    restart: unless-stopped
    networks: [mgmt]
    ports:
      - "9443:9443"          # HTTPS UI, self-signed cert (early-stage direct access)
      - "8000:8000"          # Edge-agent reverse tunnel (for edge sites)
    volumes:
      - portainer-data:/data
      - /var/run/docker.sock:/var/run/docker.sock:ro

networks:
  mgmt:

volumes:
  portainer-data: