version: "3.8"

# ─────────────────────────────────────────────
# InkNote — Deploy on Docker VM
# Pull images from Gitea container registry
#
# Usage:
#   mkdir -p /srv/inknote/db /srv/inknote/uploads
#   chown -R 1000:1000 /srv/inknote
#   docker login gitea.honeyy.duckdns.org
#   docker compose pull
#   docker compose up -d
#
# Data lives under INKNOTE_DATA_DIR (default /srv/inknote) on the host.
# Back that path up together with the .env holding ENCRYPTION_KEY — the
# database is encrypted and is unreadable without that key.
# ─────────────────────────────────────────────

services:
  inknote-server:
    image: gitea.honeyy.duckdns.org/docker/inknote-server:latest
    container_name: inknote-server
    restart: unless-stopped
    environment:
      - PORT=4000
      - JWT_SECRET=${JWT_SECRET}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      # Only used when the database has no users at all: creates the first admin.
      - INKNOTE_ADMIN_USER=${INKNOTE_ADMIN_USER:-}
      - INKNOTE_ADMIN_PASSWORD=${INKNOTE_ADMIN_PASSWORD:-}
      - NODE_ENV=production
    # Bind mounts, not named volumes: the data sits in a plain directory on the
    # Docker host, so whatever backs up the host also backs up InkNote.
    # Create it first:  mkdir -p /srv/inknote/{db,uploads} && chown -R 1000:1000 /srv/inknote
    user: "${INKNOTE_UID:-1000}:${INKNOTE_GID:-1000}"
    volumes:
      - ${INKNOTE_DATA_DIR:-/srv/inknote}/db:/app/data
      - ${INKNOTE_DATA_DIR:-/srv/inknote}/uploads:/app/uploads
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:4000/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  inknote-web:
    image: gitea.honeyy.duckdns.org/docker/inknote-web:latest
    container_name: inknote-web
    restart: unless-stopped
    ports:
      - "3000:80"
    depends_on:
      inknote-server:
        condition: service_healthy

volumes:
  inknote-data:
  inknote-uploads: