# deploy/docker/docker-compose.yml — Server-only deployment
#
# Use this when you want to run only the Arkeep server (and GUI).
# Agents on remote machines connect to this server via gRPC.
#
# Quick start:
#   cd deploy/docker
#   cp .env.example .env   # fill in required values
#   docker compose up -d

services:
  server:
    image: ghcr.io/arkeep-io/arkeep-server:latest
    container_name: arkeep-server
    restart: unless-stopped
    ports:
      - "${ARKEEP_HTTP_PORT:-8080}:8080"   # REST API + GUI
      - "${ARKEEP_GRPC_PORT:-9090}:9090"   # gRPC (agents)
    environment:
      ARKEEP_SECRET_KEY: "${ARKEEP_SECRET_KEY:?ARKEEP_SECRET_KEY is required — generate with: openssl rand -hex 32}"
      ARKEEP_AGENT_SECRET: "${ARKEEP_AGENT_SECRET:?ARKEEP_AGENT_SECRET is required — generate with: openssl rand -hex 24}"
      ARKEEP_DATA_DIR: "${ARKEEP_DATA_DIR:-/var/lib/arkeep/data}"
      ARKEEP_DB_DRIVER: "${ARKEEP_DB_DRIVER:-sqlite}"
      ARKEEP_DB_DSN: "${ARKEEP_DB_DSN:-/var/lib/arkeep/arkeep.db}"
      ARKEEP_HTTP_ADDR: ":8080"
      ARKEEP_GRPC_ADDR: ":9090"
      ARKEEP_LOG_LEVEL: "${ARKEEP_LOG_LEVEL:-info}"
      # External base URL for links in outbound email (e.g. password reset).
      # Set in production behind a reverse proxy; empty = derive from request host.
      ARKEEP_BASE_URL: "${ARKEEP_BASE_URL:-}"
      # Check GitHub for new Arkeep releases; "false" never contacts api.github.com.
      ARKEEP_UPDATE_CHECK: "${ARKEEP_UPDATE_CHECK:-true}"
      TZ: "${TZ:-UTC}"
      # ── gRPC TLS ───────────────────────────────────────────────────────────────
      # Auto-PKI (default): the server generates a private CA and server cert
      # under data-dir/grpc/ on first startup. Agents auto-enroll via HTTP and
      # connect with mTLS. No extra configuration is required.
      #
      # Option A — external cert (e.g. Let's Encrypt via certbot):
      #   Mount your certificate files and uncomment the two lines below.
      #   ARKEEP_GRPC_TLS_CERT: "/etc/arkeep/tls/tls.crt"
      #   ARKEEP_GRPC_TLS_KEY:  "/etc/arkeep/tls/tls.key"
      #
      # Option B — terminate TLS at a reverse proxy (Caddy, Nginx, Traefik):
      #   Leave these lines commented. Auto-PKI applies to direct gRPC connections
      #   on port 9090. If port 8080 is not exposed directly (only via the proxy),
      #   agents on remote machines must set ARKEEP_SERVER_HTTP_ADDR to the proxy
      #   HTTPS URL for enrollment, e.g.:
      #     ARKEEP_SERVER_HTTP_ADDR=https://arkeep.example.com
    volumes:
      - arkeep-data:/var/lib/arkeep
      # Uncomment to mount TLS certificates (Option A above):
      # - /etc/arkeep/tls:/etc/arkeep/tls:ro
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8080/health/ready"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # ── Optional: PostgreSQL ────────────────────────────────────────────────────
  # Uncomment this service and set ARKEEP_DB_DRIVER=postgres and
  # ARKEEP_DB_DSN=postgres://arkeep:${POSTGRES_PASSWORD}@postgres:5432/arkeep?sslmode=disable
  # in your .env file to use PostgreSQL instead of SQLite.
  #
  # postgres:
  #   image: postgres:16-alpine
  #   container_name: arkeep-postgres
  #   restart: unless-stopped
  #   environment:
  #     POSTGRES_USER: arkeep
  #     POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}"
  #     POSTGRES_DB: arkeep
  #   volumes:
  #     - arkeep-postgres-data:/var/lib/postgresql/data
  #   healthcheck:
  #     test: ["CMD-SHELL", "pg_isready -U arkeep"]
  #     interval: 10s
  #     timeout: 5s
  #     retries: 5

volumes:
  arkeep-data:
    driver: local
  # arkeep-postgres-data:
  #   driver: local