# BombVault on a plain Docker host (not Unraid, and not TrueNAS's own app
# system).
#
# Same image and mounts as the Unraid template (templates/my-BombVault.xml),
# except that Host Data needs no path translation the way Unraid's
# /mnt -> /host/user split does (see below).
#
# All variables are in docs/configuration.md. What does not apply outside
# Unraid (the flash drive, Unraid notifications) is listed under "Generic
# Docker host" in docs/getting-started.md.
#
# Quick start:
#   1. cp deploy/docker-compose.generic.yml docker-compose.yml
#   2. Generate APP_KEY (openssl rand -hex 32) and paste it in below.
#   3. Point the Host Data volume at your real data root (see its comment).
#   4. docker compose up -d
#   5. Open https://<this-host-ip>:3443/ (self-signed certificate out of the box).

services:
  bombvault:
    # The image the Unraid template installs; ghcr.io/junkerderprovinz/bombvault
    # works as well.
    image: junkerderprovinz/bombvault:latest
    restart: unless-stopped

    # restic records the hostname in its locks. A fixed one lets BombVault
    # clear a stale lock left by its previous container right away instead of
    # waiting 30 minutes after every recreate.
    hostname: bombvault
    container_name: bombvault

    volumes:
      # BombVault's own state: SQLite DB, TLS certificate, restic cache.
      - ./config:/config

      # Lets BombVault stop, start and recreate containers around a backup or
      # restore. This is root-equivalent access to the host, so run the stack
      # only on a trusted network.
      - /var/run/docker.sock:/var/run/docker.sock

      # Host Data: where the containers you want backed up keep their data,
      # and the default root for local backups and restores.
      #
      # Replace ./data with the absolute host path that holds your containers'
      # data, for example /srv/appdata, and set HOST_SOURCE_ROOT below to that
      # same host path. HOST_MOUNT_ROOT keeps its default of /host/user, the
      # container side of this mount.
      #
      # BombVault skips what it cannot reach through this mount, without an
      # error. Named volumes live under Docker's data root
      # (docker info -f '{{.DockerRootDir}}', usually /var/lib/docker), and the
      # "Host system config" preset on the Files page reads /etc. To back those
      # up, mount a common parent of them and your data instead, the way the
      # Unraid template mounts all of /mnt. See "Backup source detection" in
      # docs/configuration.md.
      - ./data:/host/user

    environment:
      # Required: 64 lowercase hex characters (openssl rand -hex 32). It is the
      # master key for secrets and the restic repository password; without it
      # encrypted backups cannot be restored.
      APP_KEY: ""

      # Auto-detection only recognizes Unraid and otherwise falls back to
      # generic; naming the platform avoids depending on a missing marker file.
      PLATFORM: generic

      # The real host path of the Host Data mount above. Left at /host/user it
      # equals HOST_MOUNT_ROOT's default and nothing is translated; change it
      # when the host side of the mount is a different path.
      HOST_SOURCE_ROOT: /host/user

      # VM backup (optional): uncomment to back up VMs on a libvirtd host
      # reachable over SSH, the same settings as the Unraid template's "VM
      # Backup" fields. LIBVIRT_HOST defaults to host.docker.internal, so when
      # libvirtd runs on this Docker host, uncomment extra_hosts below and set
      # only the SSH user and port.
      # LIBVIRT_HOST: 192.168.x.x       # only if libvirtd is on another host
      # LIBVIRT_SSH_USER: root
      # LIBVIRT_SSH_PORT: "22"

    # Resolves host.docker.internal to this host, for libvirtd running here.
    # extra_hosts:
    #   - host.docker.internal:host-gateway

    ports:
      # WebUI (HTTPS, self-signed certificate out of the box). This is the
      # port you open.
      - "3443:3443"
      # WebUI over HTTP, only with HTTP_ONLY=true behind a TLS-terminating
      # reverse proxy.
      # - "3000:3000"