# Captatum self-host (hosted flavor) — gateway + SQLite volume.
# This is the COMMON base for EC2 / Mac Mini / any Docker host.
#
# Trust model: the generic Compose shape intentionally does not enable Tier-3.
# A no-sandbox browser must have a distinct network namespace and enforced
# egress firewall; sharing the gateway namespace lets it impersonate the
# gateway after a restart. The production Kubernetes topology supplies that
# boundary. See docs/contracts.md and docs/threat-model.md.
#
# Image: published by release CI to ghcr.io/acartag7/captatum and
# ghcr.io/acartag7/captatum-browser. Set CAPTATUM_TAG to a release tag, or build
# locally:
#   CAPTATUM_TAG=dev docker compose -f deploy/docker-compose.yml build
#   docker compose -f deploy/docker-compose.yml up -d
# Logs: docker compose -f deploy/docker-compose.yml logs -f gateway
#
# Front the gateway with a Cloudflare Tunnel + Access app on /oauth/authorize*
# (the hosted flavor requires Cloudflare Access — see deploy/README.md). The
# gateway's published port is bound to 127.0.0.1 on the HOST so it is never
# exposed directly (the container itself binds 0.0.0.0; only the host publish is
# loopback).

services:
  gateway:
    image: ghcr.io/acartag7/captatum:${CAPTATUM_TAG:-latest}
    build:
      context: ..
      dockerfile: Dockerfile
    env_file: ../.env
    environment:
      # Hosted flavor is required (config.ts defaults to local-binary, which the
      # HTTP listener refuses — HostedFlavorError). Set it here so a .env that
      # omits it can't crash the container.
      CAPTATUM_FLAVOR: "hosted"
      # The container must bind 0.0.0.0 so the published host port can reach it
      # (the HOST port publish below stays 127.0.0.1 — loopback on the host).
      HOST: "0.0.0.0"
      # OAuth state + stored clients share the private 0700 /data volume.
      CAPTATUM_SQLITE_PATH: "/data/captatum.sqlite"
      # A host request to a Docker-published loopback port reaches the container
      # from the bridge gateway, not from container loopback. Pin both the
      # bridge and its only trusted peer so public callers keep separate rate
      # buckets. The edge authenticator from ../.env is still required.
      CAPTATUM_TRUSTED_PROXY_CIDRS: "172.29.255.249/32"
    volumes:
      - captatum-data:/data
    ports:
      - "127.0.0.1:3000:3000"
    restart: unless-stopped

volumes:
  captatum-data:

networks:
  default:
    ipam:
      config:
        - subnet: "172.29.255.248/29"
          gateway: "172.29.255.249"