# Dropnook — instant sharing for your home network
# Setup, HTTPS and updates: https://github.com/dropnook/dropnook.app
#
# Nothing to change in here: your values go into the .env next to this file —
# on Unraid: Edit Stack → tab .env; template: .env.example. So a newer
# compose.yaml can simply replace this one, and this file can be shown or
# posted without giving away an address or a PIN.
#
# Before the first start: create the Unraid share "drop", fill in the .env.
# Without Unraid: see "Without Unraid" in docs/DEVELOPMENT.md.

name: drop

x-image: &image ghcr.io/dropnook/dropnook:2   # 2.x + weekly security rebuilds

services:

  # Drop itself — reachable in your network only.
  drop:
    image: *image
    container_name: drop
    restart: unless-stopped
    # Root only for what it needs: owning the data folders, hard links for
    # shares, ports 80/443. No other capability, no way to gain more.
    cap_drop: [ALL]
    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, NET_BIND_SERVICE]
    security_opt: [no-new-privileges:true]
    mem_limit: 2g
    pids_limit: 200
    environment:
      MODE: lan
      TLS_CERT: ${TLS_CERT-auto}            # empty in the .env: no HTTPS
      TLS_KEY: ${TLS_KEY:-}
      CERTS_DIR: ${CERTS_DIR:-/mnt/user/appdata/Nginx-Proxy-Manager-Official/letsencrypt}
      SHARE_SUBDOMAIN: ${SHARE_SUBDOMAIN:-drop-share}
      PIN: ${PIN:-}
      USER_TEAL: ${USER_TEAL:-}
      USER_GOLD: ${USER_GOLD:-}
      USER_BLUE: ${USER_BLUE:-}
      USER_VIOLET: ${USER_VIOLET:-}
      USER_CORAL: ${USER_CORAL:-}
      TZ: ${TZ:-}                            # log timestamps only
      WEBUI: ${WEBUI:-}                      # Drop answers to this name (and IPs, local names)
      HOSTS: ${HOSTS:-}                      # more names, if any: drop.example.org, *.example.net
      # More settings: docs/DEVELOPMENT.md
    volumes:
      # One mount for files/, texts/ and shares/ — hard links need that. Not
      # created when missing, so a typo never turns into a new Unraid share.
      - type: bind
        source: ${DATA_DIR:-/mnt/user/drop}
        target: /data
        bind: { create_host_path: false }
      - type: bind
        source: ${APPDATA_DIR:-/mnt/user/appdata/drop}
        target: /config
        read_only: true
      # Your certificates, read-only. Never the appdata folder above.
      - type: bind
        source: ${CERTS_DIR:-/mnt/user/appdata/Nginx-Proxy-Manager-Official/letsencrypt}
        target: ${CERTS_DIR:-/mnt/user/appdata/Nginx-Proxy-Manager-Official/letsencrypt}
        read_only: true
      - /boot/config/ident.cfg:/unraid/ident.cfg:ro   # Unraid server name
    networks:
      br0:
        ipv4_address: ${DROP_IP:?DROP_IP is missing in the .env (Edit Stack - tab .env)}
    labels:
      # "WebUI" in the Docker tab: the name you open Drop under.
      net.unraid.docker.webui: ${WEBUI:-http://[IP]/}
      net.unraid.docker.icon: https://raw.githubusercontent.com/dropnook/dropnook.app/main/.github/icons/drop.png

  # Share links only — the one container your reverse proxy points to.
  drop-share:
    image: *image
    container_name: drop-share
    restart: unless-stopped
    depends_on:
      drop:
        condition: service_healthy
    # Locked down: no root, read-only, no capabilities, limited resources.
    user: "99:100"
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    tmpfs: [/tmp:size=16m]
    mem_limit: 256m
    pids_limit: 64
    sysctls:
      net.ipv4.ip_unprivileged_port_start: 80   # port 80 without root
    environment:
      MODE: public
      PORT: 80
      APP_NAME: Drop
    volumes:
      # Only what is shared, read-only — except the view counters.
      - type: bind
        source: ${DATA_DIR:-/mnt/user/drop}/shares
        target: /data/shares
        read_only: true
      - type: bind
        source: ${DATA_DIR:-/mnt/user/drop}/shares/counters
        target: /data/shares/counters
      - type: bind
        source: ${APPDATA_DIR:-/mnt/user/appdata/drop}
        target: /config
        read_only: true
    networks:
      br0:
        ipv4_address: ${SHARE_IP:?SHARE_IP is missing in the .env (Edit Stack - tab .env)}
    labels:
      net.unraid.docker.icon: https://raw.githubusercontent.com/dropnook/dropnook.app/main/.github/icons/drop-share.png

networks:
  br0:            # Unraid's network for containers with their own LAN address
    external: true