version: "3.8"

services:
  kitchen-cupboard:
    build: .
    container_name: kitchen-cupboard
    restart: unless-stopped
    ports:
      - "8111:8000"
    volumes:
      - ./data:/app/data
    environment:
      # REQUIRED: Must be a long random string. The app will refuse to start without it.
      # Generate one with: python -c "import secrets; print(secrets.token_urlsafe(64))"
      - SECRET_KEY=${SECRET_KEY:?Set SECRET_KEY to a random value of at least 32 characters}
      # Registration is disabled by default (invite codes required).
      # Set to "true" only for initial setup, then disable.
      - REGISTRATION_ENABLED=false
      # Optional comma-separated origins for browser-based agents. CLI/server agents do not need CORS.
      - CORS_ORIGINS=${CORS_ORIGINS:-}
      - PUBLIC_URL=${PUBLIC_URL:-http://localhost:8111}
      # Explicit HTTPS LAN integration hosts, if needed. TLS validation stays enabled.
      - INTEGRATION_LAN_HOSTS=${INTEGRATION_LAN_HOSTS:-}