docker-compose.yml

# APIARY — multi-service honeypot (HOME side). Kept only as a marker file;
# see the note below for what actually runs the stacks.
#
# #258: every service that used to live in this file has long since split
# into its own stack (see README.md's stack table). #1502 finished the
# rest of that split's original rationale: each stack's `build:` is now a
# relative path self-contained under arcane/home/<name>/, an
# Arcane-managed directory-aware Git sync, not an absolute
# /opt/stacks/apiary/<dir> path into this checkout any more. This file has
# no services of its own left, kept as a thin marker rather than deleted
# outright only because deploy.yml's rsync step still uses
# `docker compose -f compose.yml config --quiet` against it as a cheap
# sanity check that the checkout landed intact -- see that step's own
# comment for why the rsync itself is still needed (ghidra-worker.py's
# host-level resync).
#
# Topology (historical, describes the split stacks above, not this file):
#   attacker -> VPS public port -> [Traefik (HTTP) | portbridge socat (raw TCP/UDP)]
#            -> WireGuard tunnel -> home server (10.8.0.2)
# Every sensor binds on HP_BIND (default 10.8.0.2) — never the home LAN.
# Logs: /opt/stacks/apiary/logs/<service>/

services: {}