# Weir all-in-one (the .NET server + production web UI) from GHCR.
# This is the default `docker compose` entrypoint at repo root.
#
# From repo root:
#   docker compose pull
#   docker compose up -d
#
# Open http://localhost:9347/ after the container starts.
# Stable releases publish linux/amd64 and linux/arm64 images.
# Override the image with WEIR_DOCKER_IMAGE if needed (for a local build: `docker build -t weir:local .`
# then WEIR_DOCKER_IMAGE=weir:local docker compose up -d --pull never).

name: weir

services:
  weir:
    # A release candidate is published under its version tag only, so this names one; `latest` arrives with 1.0.0.
    # Pin a version (ghcr.io/ejm-digital/weir:X.Y.Z, from the releases page) so `docker compose pull` can't move you
    # onto an untested release without you choosing to.
    image: ${WEIR_DOCKER_IMAGE:-ghcr.io/ejm-digital/weir:1.0.0-rc.28}
    pull_policy: always
    # Weir is named after this hostname ("Weir on my-server"), so set it to your server's name.
    # Without one, Docker names the container with twelve random characters.
    # hostname: my-server
    ports:
      - "9347:9347"
      # Bind loopback-only instead, and put a reverse proxy in front for LAN/internet access:
      # - "127.0.0.1:9347:9347"
    environment:
      WEIR_HOME: ${WEIR_HOME:-/data/weir}
      # Optional UID/GID remap for the runtime account inside the container. Neither may be 0:
      # the entrypoint refuses to run the server as root.
      # WEIR_PUID: ${WEIR_PUID:-1000}
      # WEIR_PGID: ${WEIR_PGID:-1000}
      # Optional. If omitted, the container generates and persists /data/weir/session.secret.
      # To provide your own value, generate one with: openssl rand -hex 32
      # WEIR_SESSION_SECRET: ${WEIR_SESSION_SECRET}
      # Optional. If omitted, the container generates and persists /data/weir/credentials.secret.
      # WEIR_CREDENTIALS_SECRET: ${WEIR_CREDENTIALS_SECRET}
      # Optional bearer token for Prometheus or other machine scrapes of /metrics:
      # WEIR_METRICS_BEARER_TOKEN: ${WEIR_METRICS_BEARER_TOKEN}
    volumes:
      - weir_data:/data/weir
    restart: unless-stopped
    # Blocks a process from gaining more privileges than its parent (setuid binaries, etc.); the
    # entrypoint's own uid/gid remap goes through the capabilities below instead, not setuid.
    security_opt:
      - no-new-privileges:true
    # Deny everything, then grant back only what the entrypoint and server actually use:
    cap_drop:
      - ALL
    cap_add:
      - CHOWN      # entrypoint.sh fixes WEIR_HOME's owner when it doesn't match WEIR_PUID/PGID
      - SETUID     # gosu drops from root to the weir user before running the server
      - SETGID     # gosu drops from root to the weir group before running the server
      - DAC_OVERRIDE # root reads/writes WEIR_HOME once, before the gosu drop, regardless of its mode
      - FOWNER     # usermod/groupmod rewrite /etc/passwd, /etc/group and their lock files as part of the id remap

volumes:
  weir_data: