# ─────────────────────────────────────────────
# InkNote — deploy from the Gitea container registry
#
#   mkdir -p /srv/inknote/{db,uploads}
#   chown -R 1000:1000 /srv/inknote
#   cp .env.example .env && edit it        # secrets + first admin
#   docker login gitea.honeyy.duckdns.org
#   docker compose pull && docker compose up -d
#
# Data lives under INKNOTE_DATA_DIR (default /srv/inknote) on the host, so
# whatever backs up the host also backs up InkNote. Back that path up together
# with the .env: the notes are encrypted and unreadable without ENCRYPTION_KEY.
# ─────────────────────────────────────────────

services:
  inknote-server:
    image: gitea.honeyy.duckdns.org/docker/inknote-server:latest
    container_name: inknote-server
    restart: unless-stopped
    environment:
      - PORT=4000
      - JWT_SECRET=${JWT_SECRET}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      # Settles who the first administrator is — on an empty database by
      # creating them, on an upgraded one by choosing whom to promote. Ignored
      # entirely once an admin exists, so they can never reset anything.
      - INKNOTE_ADMIN_USER=${INKNOTE_ADMIN_USER:-}
      - INKNOTE_ADMIN_PASSWORD=${INKNOTE_ADMIN_PASSWORD:-}
      - NODE_ENV=production
      # Optional tuning; unset means the server's own defaults apply.
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-}
      - INKNOTE_MAX_IMAGE_MB=${INKNOTE_MAX_IMAGE_MB:-}
      - INKNOTE_MAX_PDF_MB=${INKNOTE_MAX_PDF_MB:-}
      - MAX_VERSIONS_PER_NOTE=${MAX_VERSIONS_PER_NOTE:-}
      - VERSION_RETENTION_DAYS=${VERSION_RETENTION_DAYS:-}
      - VERSION_COALESCE_MINUTES=${VERSION_COALESCE_MINUTES:-}
      # Signing in through an identity provider — see .env.example. Unset means
      # the app is password-only and the sign-in screen shows nothing about it.
      - INKNOTE_PUBLIC_URL=${INKNOTE_PUBLIC_URL:-}
      - INKNOTE_OIDC_ISSUER=${INKNOTE_OIDC_ISSUER:-}
      - INKNOTE_OIDC_CLIENT_ID=${INKNOTE_OIDC_CLIENT_ID:-}
      - INKNOTE_OIDC_CLIENT_SECRET=${INKNOTE_OIDC_CLIENT_SECRET:-}
      - INKNOTE_OIDC_LABEL=${INKNOTE_OIDC_LABEL:-}
      - INKNOTE_OIDC_SCOPES=${INKNOTE_OIDC_SCOPES:-}
      - INKNOTE_OIDC_REDIRECT_URI=${INKNOTE_OIDC_REDIRECT_URI:-}
    user: "${INKNOTE_UID:-1000}:${INKNOTE_GID:-1000}"
    # Bind mounts, so the data is a plain directory on the host.
    # ${VAR:-fallback} means "VAR, or fallback if VAR is empty" — one or the
    # other, never both. Set INKNOTE_DATA_DIR=/root/inknote and the paths below
    # are /root/inknote/db and /root/inknote/uploads; /srv is then never used.
    volumes:
      - ${INKNOTE_DATA_DIR:-/srv/inknote}/db:/app/data
      - ${INKNOTE_DATA_DIR:-/srv/inknote}/uploads:/app/uploads
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4000/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  inknote-web:
    image: gitea.honeyy.duckdns.org/docker/inknote-web:latest
    container_name: inknote-web
    restart: unless-stopped
    ports:
      - "3000:80"
    depends_on:
      inknote-server:
        condition: service_healthy