# ============================================
# SealShare - Docker Compose Configuration
# ============================================
#
# Quick start:
#   1. Copy this file:  cp docker-compose.example.yml docker-compose.yml
#   2. Edit the settings below (APP_URL is required; uploads need HTTPS, see below)
#   3. Start:  docker compose up -d
#   4. Open your browser to your configured domain
#
# Note: APP_KEY is auto-generated on first start if not set.
#       Copy it from the logs into your docker-compose.yml to persist across restarts.
#
# ============================================

services:
  # ------------------------------------------
  # SealShare Application (FrankenPHP/Octane)
  # ------------------------------------------
  app:
    image: gitea.nonameweb.ch/nonameweb/sealshare:latest
    restart: unless-stopped
    ports:
      - "80:80"       # HTTP
      - "443:443"     # HTTPS (a Let's Encrypt certificate with AUTO_HTTPS)
      - "443:443/udp" # HTTP/3 (QUIC)
    volumes:
      - sealshare_storage:/app/storage/app   # Uploaded & encrypted files
      - sealshare_database:/app/database      # SQLite database
      - caddy_data:/data                      # TLS certificates
      - caddy_config:/config                  # Caddy configuration
    environment:
      # --- REQUIRED ---
      APP_URL:              # Your full URL, e.g. https://share.example.com
      # APP_KEY:            # Auto-generated if not set. Copy from logs to persist across restarts.

      # --- HTTPS ---
      # Files are encrypted in the uploader's browser, which browsers only allow over HTTPS (or on
      # localhost). Either let this container fetch a Let's Encrypt certificate (ports 80 and 443
      # reachable from the internet), or put a reverse proxy that terminates TLS in front of port 80.
      # AUTO_HTTPS: "true"
      # SERVER_NAME: share.example.com  # The domain to fetch the certificate for (only with AUTO_HTTPS)

      # --- Optional: Application ---
      # APP_ENV: production
      # APP_DEBUG: "false"
      # LOG_CHANNEL: stderr
      # LOG_LEVEL: warning

      # --- Optional: Database ---
      # DB_CONNECTION: sqlite           # Options: sqlite, mysql, pgsql
      # DB_HOST:                        # Required for mysql/pgsql
      # DB_PORT:                        # Required for mysql/pgsql
      # DB_DATABASE:                    # Required for mysql/pgsql
      # DB_USERNAME:                    # Required for mysql/pgsql
      # DB_PASSWORD:                    # Required for mysql/pgsql

      # --- Optional: Octane ---
      # OCTANE_HTTPS: "false"           # Set to "true" when using HTTPS
      # OCTANE_MAX_EXECUTION_TIME: 300  # Max request execution time (seconds)

      # --- Optional: Uploads ---
      # UPLOAD_CHUNK_SIZE_MB: "16"      # Each encrypted chunk the browser sends; a reverse proxy must accept a little more

      # --- Optional: PHP limits ---
      # PHP_UPLOAD_MAX_FILESIZE: "64M"  # Only for the admin's logo upload: shares upload in chunks
      # PHP_POST_MAX_SIZE: "64M"
      # PHP_MAX_EXECUTION_TIME: "300"
      # PHP_MAX_INPUT_TIME: "300"
      # PHP_MEMORY_LIMIT: "512M"
    healthcheck:
      test: ["CMD", "/app/docker/healthcheck.sh"]
      interval: 30s
      timeout: 5s
      start_period: 10s
      retries: 3

  # ------------------------------------------
  # Scheduler - Runs cleanup for expired shares
  # ------------------------------------------
  scheduler:
    image: gitea.nonameweb.ch/nonameweb/sealshare:latest
    restart: unless-stopped
    entrypoint: ["php", "artisan", "schedule:work"]
    volumes:
      - sealshare_storage:/app/storage/app
      - sealshare_database:/app/database
    environment:
      # APP_KEY:            # Same key as the app service above (auto-generated if not set)
      APP_URL:              # Same URL as the app service above
    depends_on:
      app:
        condition: service_healthy

volumes:
  sealshare_storage:    # Persistent: uploaded & encrypted files
  sealshare_database:   # Persistent: SQLite database
  caddy_data:           # Persistent: TLS certificates
  caddy_config:         # Persistent: Caddy configuration