name: bokf

services:
  bokfd:
    image: ${BOKF_IMAGE:-ghcr.io/yourname/bokf}:${BOKF_TAG:-latest}
    build:
      context: .
    restart: unless-stopped
    ports:
      - "8788:8788"
    volumes:
      - ./var/db:/var/lib/bokfd
      - ./var/run:/run/bokfd
    environment:
      BOKFD_DB: /var/lib/bokfd/bokfd.db
      BOKFD_SOCKET: /run/bokfd/bokfd.sock
      BOKFD_BACKUP_DIR: /var/lib/bokfd/backup
      BOKFD_EXPORT_DIR: /var/lib/bokfd/export
      BOKFD_LOG_LEVEL: info
      BOKFD_SECRET_KEY: ${BOKFD_SECRET_KEY:-}
      BOKFD_TLS: 0.0.0.0:8788
      BOKFD_TLS_CERT: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.crt
      BOKFD_TLS_KEY: /var/lib/bokfd/certs/certificates/${LEGO_DOMAIN:-bokf.makandra.eu}.key

  # Web frontend: login gate + browser terminal on http://127.0.0.1:8790.
  # The host's TLS proxy serves it as https://bokf.makandra.eu/web (see
  # deploy/Caddyfile and docs/DEPLOY.md). Talks to bokfd over the socket
  # only; read-only, no capabilities.
  web:
    image: ${BOKF_WEB_IMAGE:-bokf-web}:${BOKF_TAG:-latest}
    restart: unless-stopped
    depends_on:
      - bokfd
    ports:
      - "127.0.0.1:8790:8790"
    volumes:
      - ./var/run:/run/bokfd
    environment:
      BOKF_WEB_MAX_SESSIONS: ${BOKF_WEB_MAX_SESSIONS:-20}
    read_only: true
    tmpfs:
      - /tmp:size=256m,mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 512
    mem_limit: 2g

  certs:
    image: goacme/lego:latest
    restart: unless-stopped
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        while :; do
          if [ -n "$INWX_USERNAME" ] && [ -n "$INWX_PASSWORD" ]; then
            /lego run --path=/certs --email="$LEGO_EMAIL" --dns=inwx \
              --domains="$LEGO_DOMAIN" --accept-tos --renew-days=30 || true
            chown -R 10001:10001 /certs || true
          else
            echo "certs: set INWX_USERNAME and INWX_PASSWORD in .env"
          fi
          sleep 12h
        done
    environment:
      LEGO_EMAIL: ${LEGO_EMAIL:-anders@makandra.eu}
      LEGO_DOMAIN: ${LEGO_DOMAIN:-bokf.makandra.eu}
      INWX_USERNAME: ${INWX_USERNAME:-}
      INWX_PASSWORD: ${INWX_PASSWORD:-}
    volumes:
      - ./var/db/certs:/certs