services:
  inkweld:
    image: ghcr.io/${GITHUB_REPOSITORY_OWNER:-bobbyquantum}/inkweld:${IMAGE_TAG:-latest}
    container_name: inkweld
    environment:
      # Database Configuration
      - DB_TYPE=${DB_TYPE:-sqlite}
      - DB_PATH=${DB_PATH:-/data/sqlite.db}
      - DATA_PATH=${DATA_PATH:-/data/yjs}

      # Server Configuration
      - PORT=8333
      - HOST=0.0.0.0
      - NODE_ENV=production
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-http://localhost:8333}

      # Frontend serving (set to 'false' to disable)
      - SERVE_FRONTEND=${SERVE_FRONTEND:-true}

      # Auth Configuration
      - SESSION_SECRET=${SESSION_SECRET:?SESSION_SECRET is required}
      - USER_APPROVAL_REQUIRED=${USER_APPROVAL_REQUIRED:-true}
      - TRUST_PROXY=${TRUST_PROXY:-false}
      - GITHUB_ENABLED=${GITHUB_ENABLED:-false}
      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID:-}
      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET:-}
      - OIDC_ENABLED=${OIDC_ENABLED:-false}
      - OIDC_ONLY=${OIDC_ONLY:-false}
      - OIDC_ISSUER_URL=${OIDC_ISSUER_URL:-}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
      - OIDC_CALLBACK_URL=${OIDC_CALLBACK_URL:-}

      # Passkeys (WebAuthn)
      - WEBAUTHN_RP_ID=${WEBAUTHN_RP_ID:-localhost}
      - WEBAUTHN_RP_NAME=${WEBAUTHN_RP_NAME:-Inkweld}
      - PASSKEYS_ENABLED=${PASSKEYS_ENABLED:-true}
      - PASSWORD_LOGIN_ENABLED=${PASSWORD_LOGIN_ENABLED:-false}
      - EMAIL_RECOVERY_ENABLED=${EMAIL_RECOVERY_ENABLED:-false}
      - APP_MODE=${APP_MODE:-BOTH}

      # Email / SMTP
      - EMAIL_ENABLED=${EMAIL_ENABLED:-false}
      - EMAIL_HOST=${EMAIL_HOST:-}
      - EMAIL_PORT=${EMAIL_PORT:-587}
      - EMAIL_ENCRYPTION=${EMAIL_ENCRYPTION:-starttls}
      - EMAIL_USERNAME=${EMAIL_USERNAME:-}
      - EMAIL_PASSWORD=${EMAIL_PASSWORD:-}
      - EMAIL_FROM=${EMAIL_FROM:-}
      - EMAIL_FROM_NAME=${EMAIL_FROM_NAME:-Inkweld}
    volumes:
      - inkweld_data:/data
    ports:
      - "${PORT:-8333}:8333"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8333/api/v1/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

volumes:
  inkweld_data:
    # Persistent storage for SQLite database and Yjs documents