name: cruciverb

services:
  app:
    image: git.lashman.live/lashman/cruciverb:latest
    container_name: cruciverb
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '2.0'
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8080/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    ports:
      - "${PORT:-8484}:8080"
    volumes:
      - ./data:/app/data
    environment:
      PORT: 8080
      DATA_DIR: /app/data
      STATIC_DIR: /app/static
      RUST_LOG: info

      # where your instance lives - set this before first start
      INSTANCE_URL: http://localhost:8484
      CORS_ORIGIN: http://localhost:8484

      # webauthn / passkeys
      RP_ID: localhost
      RP_ORIGIN: http://localhost:8484

      # activitypub federation
      AP_DOMAIN: localhost
      AP_ACTOR_NAME: cruciverb

      # admin - leave empty, use first-run setup via browser instead
      ADMIN_PATH: /admin

      # enable if you sit behind a trusted reverse proxy that sets x-forwarded-for
      # TRUST_PROXY: "true"

      # set to enable at-rest encryption of user data. make one with:
      #   openssl rand -hex 32
      # DATA_ENC_KEY: ""