name: bokf

services:
  bokfd:
    image: ${BOKF_IMAGE:-ghcr.io/yourname/bokf}:${BOKF_TAG:-latest}
    build:
      context: .
    restart: unless-stopped
    ports:
      - "8788:8788"
    volumes:
      - ./var/db:/var/lib/bokfd
      - ./var/run:/run/bokfd
    environment:
      BOKFD_DB: /var/lib/bokfd/bokfd.db
      BOKFD_SOCKET: /run/bokfd/bokfd.sock
      BOKFD_BACKUP_DIR: /var/lib/bokfd/backup
      BOKFD_EXPORT_DIR: /var/lib/bokfd/export
      BOKFD_LOG_LEVEL: info
      BOKFD_TLS: 0.0.0.0:8788
      BOKFD_TLS_CERT: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.crt
      BOKFD_TLS_KEY: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.key

  certs:
    image: goacme/lego:latest
    restart: unless-stopped
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        while :; do
          if [ -n "$INWX_USERNAME" ] && [ -n "$INWX_PASSWORD" ]; then
            /lego run --path=/certs --email="$LEGO_EMAIL" --dns=inwx \
              --domains="$LEGO_DOMAIN" --accept-tos --renew-days=30 || true
            chown -R 10001:10001 /certs || true
          else
            echo "certs: set INWX_USERNAME and INWX_PASSWORD in .env"
          fi
          sleep 12h
        done
    environment:
      LEGO_EMAIL: ${LEGO_EMAIL:-anders@makandra.eu}
      LEGO_DOMAIN: ${LEGO_DOMAIN:-bokf.makandra.eu}
      INWX_USERNAME: ${INWX_USERNAME:-}
      INWX_PASSWORD: ${INWX_PASSWORD:-}
    volumes:
      - ./var/db/certs:/certs