services:
  immich-family-tools:
    build:
      context: .
      dockerfile: Dockerfile
      # #68: Commit, aus dem gebaut wird — `/api/health` gibt ihn aus.
      # `GIT_SHA=$(git rev-parse HEAD) docker compose up -d --build` setzen;
      # ohne den Aufruf bleibt es beim Vorgabewert "unknown" (App startet
      # trotzdem). Details: docs/agents/release-ritual.md, Schritt 9.
      args:
        GIT_SHA: ${GIT_SHA:-unknown}
    image: immich-family-tools:latest
    container_name: immich-family-tools
    restart: unless-stopped
    ports:
      - "3100:3100"
    volumes:
      # POSIX ZFS dataset – must be created BEFORE first start:
      # zfs create -o acltype=posix -o xattr=sa HDDs/Applications/immich-family-tools
      # zfs create -o acltype=posix -o xattr=sa HDDs/Applications/immich-family-tools/data
      # chown -R 3006:3006 /mnt/HDDs/Applications/immich-family-tools
      - /mnt/HDDs/Applications/immich-family-tools/data:/app/data
    environment:
      - IMMICH_FAMILY_TOOLS_PORT=3100
      - IMMICH_FAMILY_TOOLS_SECRET=${IMMICH_FAMILY_TOOLS_SECRET:?Set IMMICH_FAMILY_TOOLS_SECRET in .env}
      - IMMICH_FAMILY_TOOLS_SESSION_TTL_HOURS=${IMMICH_FAMILY_TOOLS_SESSION_TTL_HOURS:-168}
      - IMMICH_FAMILY_TOOLS_COOKIE_SECURE=${IMMICH_FAMILY_TOOLS_COOKIE_SECURE:-false}
      - CONFIG_PATH=/app/data/accounts.json
      - LOG_LEVEL=info
      - TZ=${TZ:-Europe/Vienna}
    user: "3006:3006"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:3100/api/health', timeout=5)"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    # Internal network only – Caddy should NOT reverse-proxy this to the internet
    # without adding authentication (e.g. basic auth or Authelia)
    networks:
      - default

networks:
  default:
    driver: bridge