name: cruciverb

# copy this to docker-compose.yml (or point compose at it with -f) and
# copy .env.example to .env before starting

services:
  app:
    image: git.lashman.live/lashman/cruciverb:latest
    container_name: cruciverb
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '2.0'
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8080/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    ports:
      - "${PORT:-8484}:8080"
    volumes:
      - ./data:/app/data
    environment:
      PORT: 8080
      DATA_DIR: /app/data
      STATIC_DIR: /app/static
      RUST_LOG: info

      # where your instance lives
      INSTANCE_URL: ${INSTANCE_URL:-http://localhost:8484}
      CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:8484}

      # webauthn / passkeys
      RP_ID: ${RP_ID:-localhost}
      RP_ORIGIN: ${RP_ORIGIN:-http://localhost:8484}

      # activitypub federation
      AP_DOMAIN: ${AP_DOMAIN:-localhost}
      AP_ACTOR_NAME: ${AP_ACTOR_NAME:-cruciverb}

      # admin - leave empty, use first-run setup via browser instead
      ADMIN_PATH: /admin

      # set to true when nginx/caddy sits in front and sets x-forwarded-for
      TRUST_PROXY: ${TRUST_PROXY:-false}

      # at-rest encryption for user data - generate yours with
      #   openssl rand -hex 32
      DATA_ENC_KEY: ${DATA_ENC_KEY:-}