services:
  topic-watch:
    # TOPIC_WATCH_IMAGE is written to .env by install.sh/install.ps1/update.sh
    # after a successful pull, pinned to the exact digest just verified
    # healthy — so a later restart (reboot, systemd, `docker compose up`)
    # reruns that known-good image instead of silently re-resolving the
    # movable "latest" tag to whatever is newest on the registry.
    image: ${TOPIC_WATCH_IMAGE:-ghcr.io/0xzerolight/topic_watch:latest}
    container_name: topic-watch
    ports:
      # Loopback by default: Topic Watch has no authentication, and Docker's
      # published ports are inserted ahead of ufw/firewalld rules, so publishing
      # on every interface would expose it even on a host whose firewall denies
      # incoming traffic. Set TOPIC_WATCH_BIND_ADDR=0.0.0.0 in .env to reach it
      # from other devices, and put it behind an authenticating reverse proxy.
      - "${TOPIC_WATCH_BIND_ADDR:-127.0.0.1}:${TOPIC_WATCH_PORT:-8000}:8000"
    volumes:
      - ./data:/app/data
    restart: unless-stopped
    healthcheck:
      # OVH-122: explicit urlopen timeout (< the 5s Docker timeout) so the probe
      # is self-bounded if /health hangs, rather than relying on Docker's SIGKILL.
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=4)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      resources:
        limits:
          memory: 512M
    environment:
      - TZ=${TZ:-UTC}
      # Match the bind-mounted ./data ownership to your host user so the
      # container can write the database/config. Defaults to 1000 (the typical
      # first Linux user). If `id -u` on your host is not 1000, set PUID/PGID
      # (the install script writes these to .env automatically).
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      # Only send cookies over HTTPS. TOPIC_WATCH_SECURE_COOKIES in .env
      # reaches the container through this line — uncommenting it there alone
      # is not enough, since .env only fills in ${...} placeholders here.
      - TOPIC_WATCH_SECURE_COOKIES=${TOPIC_WATCH_SECURE_COOKIES:-false}
      # Extra hostnames the app answers to (comma-separated). Empty by default:
      # localhost, *.local and any IP address are already accepted. Set it in
      # .env when a reverse proxy forwards a hostname.
      - TOPIC_WATCH_ALLOWED_HOSTS=${TOPIC_WATCH_ALLOWED_HOSTS:-}