# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Evelin-Commercial
#
# Reference compose for a single-host Evelin server.
#
# Usage:
#   1. Generate the server identity once:
#        docker compose run --rm keygen
#      (writes /etc/evelin/server.key inside the named volume)
#   2. Distribute the printed fingerprint to your clients via
#      a trusted channel.
#   3. Populate ./config/authorized_keys with one line per
#      authorized client (see examples/authorized_keys).
#   4. docker compose up -d evelin
#
# The image is intentionally not tagged latest. Pin the tag
# in production (e.g. image: evelin:0.1.0).

services:
  evelin:
    image: evelin:0.1.0
    build:
      context: .
      dockerfile: Dockerfile
    container_name: evelin-server
    restart: unless-stopped
    ports:
      - "2200:2200"
    volumes:
      - evelin-state:/etc/evelin
      - ./config/server.toml:/etc/evelin/server.toml:ro
      - ./config/authorized_keys:/etc/evelin/authorized_keys:ro
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: ["CMD", "/usr/local/bin/evelin-keygen", "--help"]
      interval: 30s
      timeout: 5s
      retries: 3

  # One-shot key generation. Run with:
  #   docker compose run --rm keygen
  keygen:
    image: evelin:0.1.0
    build:
      context: .
      dockerfile: Dockerfile
    profiles: ["init"]
    entrypoint: ["/usr/local/bin/evelin-keygen"]
    command: ["--out", "/etc/evelin/server.key"]
    volumes:
      - evelin-state:/etc/evelin

volumes:
  evelin-state:
    driver: local