services:
  ucm:
    image: neyslim/ultimate-ca-manager:latest
    container_name: ucm
    restart: unless-stopped
    
    ports:
      # UCM listens inside the container on UCM_HTTPS_PORT
      - "${UCM_HTTPS_PORT:-8443}:${UCM_HTTPS_PORT:-8443}"
      - "${UCM_HTTP_PORT:-8080}:8080"
    
    volumes:
      # Persistent data volume (REQUIRED)
      - ucm-data:/opt/ucm/data

      # SoftHSM tokens live in the data volume since 2.233. This older volume is
      # read once, at the first start of 2.233, to carry its tokens over.
      - ucm-hsm-tokens:/var/lib/softhsm/tokens

      # Optional: Custom HTTPS certificates
      # - ./certs/https_cert.pem:/opt/ucm/data/https_cert.pem:ro
      # - ./certs/https_key.pem:/opt/ucm/data/https_key.pem:ro
    
    environment:
      # ========================================
      # CORE SETTINGS (REQUIRED)
      # ========================================
      
      # FQDN - CRITICAL for Docker (hostname detection doesn't work)
      - UCM_FQDN=${UCM_FQDN:-ucm.local}
      
      # Ports
      - UCM_HTTPS_PORT=${UCM_HTTPS_PORT:-8443}
      - UCM_HTTP_PORT=${UCM_HTTP_PORT:-8080}
      
      # Debug & Logging
      - UCM_DEBUG=${UCM_DEBUG:-false}
      - UCM_LOG_LEVEL=${UCM_LOG_LEVEL:-INFO}
      
      # ========================================
      # SECURITY (REQUIRED)
      # ========================================
      
      # Auto-generated if not provided
      - UCM_SECRET_KEY=${UCM_SECRET_KEY:-}
      - UCM_JWT_SECRET=${UCM_JWT_SECRET:-}
      
      # ========================================
      # DATABASE
      # ========================================
      
      - UCM_DATABASE_PATH=${UCM_DATABASE_PATH:-/opt/ucm/data/ucm.db}
      - UCM_BACKUP_ENABLED=${UCM_BACKUP_ENABLED:-true}
      - UCM_BACKUP_RETENTION_DAYS=${UCM_BACKUP_RETENTION_DAYS:-30}

      # SMTP, ACME, mTLS, session timeout and certificate defaults are set
      # in the web interface and stored in the database, not here.
      
      # ========================================
      # CUSTOM HTTPS CERTIFICATES (OPTIONAL)
      # ========================================
      
      # Paste PEM-encoded certificate/key here or mount as volumes
      - UCM_HTTPS_CERT=${UCM_HTTPS_CERT:-}
      - UCM_HTTPS_KEY=${UCM_HTTPS_KEY:-}
    
    healthcheck:
      test: ["CMD", "curl", "-f", "-k", "https://localhost:${UCM_HTTPS_PORT:-8443}/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    
    # Security settings
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    read_only: false  # Needs to write to database
    
    # Resource limits (adjust based on your hardware)
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    
    networks:
      - ucm-network
    
    labels:
      - "com.ultimate-ca-manager.description=Certificate Authority Management"
      - "traefik.enable=false"  # Disable if using Traefik

networks:
  ucm-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16

volumes:
  ucm-data:
    driver: local
  ucm-hsm-tokens:
    driver: local