services:
  arch-dev:
    build:
      context: .
      args:
        USER_UID: ${UID:-1000}
        USER_GID: ${GID:-1000}
    image: arch-dev:latest
    container_name: arch-dev
    hostname: arch-dev
    stdin_open: true
    tty: true

    volumes:
      - ./workspace:/workspace
      - arch-dev-home:/home/dev

    environment:
      - TERM=xterm-256color
      - MOBILE=${MOBILE:-0}
      - GIT_AUTHOR_NAME=${GIT_NAME:-dev}
      - GIT_AUTHOR_EMAIL=${GIT_EMAIL:-dev@localhost}
      - GIT_COMMITTER_NAME=${GIT_NAME:-dev}
      - GIT_COMMITTER_EMAIL=${GIT_EMAIL:-dev@localhost}

    # Capability set — cap_drop ALL then re-add only what's needed
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE   # mosh, bind <1024
      - SETUID             # sudo
      - SETGID             # sudo
      - AUDIT_WRITE        # sudoers_audit plugin
      - NET_ADMIN          # tailscale
      - NET_RAW            # tailscale
      - CHOWN              # pacman
      - DAC_OVERRIDE       # pacman
      - FOWNER             # pacman
      - SYS_ADMIN          # sshfs/FUSE mounts (roaming ~)

    # Devices: tun for tailscale, fuse for sshfs
    devices:
      - /dev/net/tun:/dev/net/tun
      - /dev/fuse:/dev/fuse

    # FUSE mounts need apparmor unconfined on many hosts
    # (remove if your host doesn't use apparmor)
    security_opt:
      - apparmor:unconfined

volumes:
  arch-dev-home: