# Degoog + Valkey shared cache.
# Good for: multi-replica deployments, public instances that want fast consistent caching.
# Valkey keeps cache and settings invalidation in sync across all degoog processes.
#
# Setup:
#   mkdir -p ./data && sudo chown -R 1000:1000 ./data

services:
  degoog:
    image: ghcr.io/degoog-org/degoog:latest
    volumes:
      - ./data:/app/data
    ports:
      - "4444:4444"
    restart: unless-stopped
    environment:
      # Leave both unset only for trusted local/LAN use. If this instance is
      # reachable from the internet, SET A PASSWORD: an unlocked instance lets
      # anyone install extensions, which runs code on the server.
      # DEGOOG_SETTINGS_PASSWORDS: "set-a-strong-password-here"
      # When "true", every admin and store action stays behind the password
      # above even on a local network.
      DEGOOG_PUBLIC_INSTANCE: "false"
      DEGOOG_VALKEY_URL: "redis://degoog-valkey:6379"
    depends_on:
      - degoog-valkey

  degoog-valkey:
    image: valkey/valkey:8-alpine
    command: ["valkey-server", "--save", "", "--appendonly", "no"]
    restart: unless-stopped
    user: "1000:1000"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true