# B3 Hive — single all-in-one container.
# Quick start:
#   (optional) cp .env.example .env   # only if you want to change settings
#   docker compose up -d          # pulls the published image
# Upgrade:
#   docker compose pull && docker compose up -d   # default tag is 'latest'
# Pin a version: set B3_IMAGE_TAG=vX.Y.Z-beta in .env
# Build from source instead (development):
#   docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build

services:
  b3hive:
    image: ghcr.io/engzizo79/b3hive:${B3_IMAGE_TAG:-latest}
    container_name: b3hive
    restart: unless-stopped
    env_file:
      - path: .env
        required: false   # optional: every setting has a default
    environment:
      # Data dir inside the container; the host side of this mapping holds
      # chain state, wallet, and b3coin.conf across upgrades.
      # IMPORTANT: the volume below MUST be mapped to THIS EXACT path.
      # If you change B3_DATA_DIR, change the volume target to match —
      # the persistence guard checks this path, and every state file
      # (wallet, chain, DB, config) lives here. A mismatch = refused startup.
      B3_DATA_DIR: /data
      # Local trust: loopback + the Docker host are local (2FA bypass,
      # first-run setup). Extra addresses / opt-out: see .env.example.
      B3_LOCAL_ADDRS: ${B3_LOCAL_ADDRS:-}
      B3_TRUST_DOCKER_HOST: ${B3_TRUST_DOCKER_HOST:-true}
    ports:
      # The UI port. The node RPC binds to 127.0.0.1 inside the container
      # and is NEVER published — unlike RPC, that's not a security-vs-
      # convenience tradeoff, it is a hard rule.
      # To make the UI reachable from THIS machine only, use instead:
      #   - "127.0.0.1:${WEB_PORT:-8080}:8080"
      - "${WEB_PORT:-8080}:8080"
      # P2P (node-to-node), published by default so this node can accept
      # INBOUND peer connections — same as a native install's listen=1.
      # Unlike RPC, the P2P protocol is DESIGNED to be internet-facing, so
      # publishing it is not a security tradeoff. Harmless if unreachable
      # (e.g. no router port-forward set up) — the node just stays
      # outbound-only, exactly like today.
      # Change B3_P2P_PORT in .env if your router only forwards specific
      # ports (e.g. running several daemons, each needs its own port in
      # the allowed range) — it must match b3coin.conf's `port=`, which
      # the entrypoint seeds from the same variable on first run.
      # Comment this line out entirely if you don't want this node
      # reachable at all (it still works fine as an outbound-only client).
      - "${B3_P2P_PORT:-5647}:${B3_P2P_PORT:-5647}"
    volumes:
      # Map a host directory (default: ~/.B3-CoinV2).
      - ${B3_DATA_DIR:-~/.B3-CoinV2}:/data
    # Resource sanity limits (optional; tune per host)
    # mem_limit: 4g
    stop_grace_period: 10m   # give b3coind time for a clean shutdown