name: wilik

services:
  backend:
    build: ./backend
    image: ghcr.io/joostvanopdorp/wilik-backend:latest
    environment:
      SECRET_KEY: ${SECRET_KEY:?set SECRET_KEY in .env}
    volumes:
      - wilik-data:/app/instance
    restart: unless-stopped
    labels:
      # Wilik doesn't ship an updater. This label lets a Watchtower you run yourself
      # (with WATCHTOWER_LABEL_ENABLE, see DEPLOY.md) update this container.
      - "com.centurylinklabs.watchtower.enable=true"
      - "docker-volume-backup.stop-during-backup=true"

  frontend:
    build: ./frontend
    image: ghcr.io/joostvanopdorp/wilik-frontend:latest
    ports:
      # WILIK_PORT in .env changes the published port. Set it to e.g. 127.0.0.1:8090
      # to keep Wilik off the LAN when a reverse proxy reaches it over a Docker network.
      - "${WILIK_PORT:-8090}:80"
    depends_on:
      - backend
    restart: unless-stopped
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

  backup:
    profiles: ["backup"]
    image: offen/docker-volume-backup:v2
    # v2 is a rolling tag: `docker compose pull` (or your updater) picks up new v2
    # releases; a new major (v3) needs a change here.
    labels:
      - "com.centurylinklabs.watchtower.enable=true"
    environment:
      # The schedule runs in TZ (default UTC).
      TZ: ${TZ:-}
      BACKUP_CRON_EXPRESSION: ${BACKUP_CRON_EXPRESSION:-0 3 * * *}
      BACKUP_FILENAME: "wilik-backup-%Y-%m-%dT%H-%M-%S.tar.gz"
      BACKUP_PRUNING_PREFIX: "wilik-backup-"
      BACKUP_RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-30}
      AWS_S3_BUCKET_NAME: ${BACKUP_S3_BUCKET:-}
      AWS_S3_PATH: "wilik"
      AWS_ACCESS_KEY_ID: ${BACKUP_S3_ACCESS_KEY_ID:-}
      AWS_SECRET_ACCESS_KEY: ${BACKUP_S3_SECRET_ACCESS_KEY:-}
      AWS_ENDPOINT: ${BACKUP_S3_ENDPOINT:-s3.amazonaws.com}
      NOTIFICATION_URLS: ${BACKUP_NOTIFICATION_URL:-}
    volumes:
      - wilik-data:/backup/wilik-data:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped

volumes:
  wilik-data: