# Borg UI - Docker Compose Configuration
#
# Zero-configuration setup with smart defaults:
# - SECRET_KEY: Auto-generated and persisted to /data/.secret_key
# - DATABASE_URL: Auto-configured to /data/borg.db
# - LOG_LEVEL: Defaults to INFO
# - PORT: Defaults to 8081
#
# Configure backup repositories through the web UI (not Docker volumes)
# Repositories can be local paths, SSH/SFTP, or cloud storage

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      target: production
      args:
        - APP_VERSION=${APP_VERSION:-local-dev}
    container_name: borg-web-ui
    restart: unless-stopped

    # Privileged mode: Required ONLY for remote-to-remote backups via SSHFS
    # This allows mounting remote SSH locations as local filesystems
    # If you only use local or direct SSH backups, you can disable this
    # See: docs/installation.md for details
    privileged: true

    ports:
      - "${PORT:-8081}:${PORT:-8081}"

    volumes:
      # Application data (database, logs, SSH keys)
      - borg_data:/data

      # Borg repository cache (improves backup performance)
      - borg_cache:/home/borg/.cache/borg

      # System mounts
      - /etc/localtime:/etc/localtime:ro # Sync timezone with host

      # Filesystem access for backups
      # ⚠️ IMPORTANT: Replace with specific directories in production
      # Default mounts entire root filesystem (development/testing only)
      - ${LOCAL_STORAGE_PATH:-/}:/local:rw

      # Production examples (replace the line above):
      # - /home/yourusername:/local:rw
      # - /var/www:/local/www:ro
      # - /mnt/data:/local/data:rw
      #
      # Any container path works — /local is just a convention.
      # If you use a different path, update LOCAL_MOUNT_POINTS below to match.
      # Example with custom paths:
      # - /mnt/disk1:/disk1:rw
      # - /home/user:/home:rw
      # (also set: LOCAL_MOUNT_POINTS=/disk1,/home)

      # Optional: Docker container management in backup scripts.
      # Direct socket access is simple but gives Borg UI broad host-level
      # Docker control. For a reduced app-container surface, remove/comment
      # this mount, uncomment the docker-socket-proxy service sample below,
      # start the docker-socket-proxy profile, and set DOCKER_HOST in the app
      # environment.
      # See: docs/docker-hooks.md
      - /var/run/docker.sock:/var/run/docker.sock:rw

    environment:
      # Core settings (optional, all have defaults)
      - PORT=${PORT:-8081}
      - ENVIRONMENT=${ENVIRONMENT:-production}

      # User/Group IDs for file permissions
      # Match your host user: id -u && id -g
      - PUID=${PUID:-1001}
      - PGID=${PGID:-1001}

      # Timezone (optional, defaults to host via /etc/localtime)
      # Examples: America/New_York, Europe/London, Asia/Kolkata
      - TZ=${TZ:-}

      # Advanced options (uncomment to customize)
      # - LOG_LEVEL=DEBUG
      # - INITIAL_ADMIN_PASSWORD=your-secure-password
      # - SECRET_KEY=your-custom-secret-key

      # Sub-path for reverse proxy deployment (e.g., /borg-ui)
      # Leave empty or unset for root deployment. See docs/reverse-proxy.md for NGINX config.
      # - BASE_PATH=/borg-ui
      #
      # Cloud Storage OAuth callbacks for Google Drive and Microsoft OneDrive.
      # Set PUBLIC_BASE_URL to the public HTTPS URL users open in their browser.
      # Register the matching /api/rclone/oauth/callback/<provider> URLs with
      # the provider OAuth app. Save provider client IDs/secrets in Borg UI.
      # - PUBLIC_BASE_URL=https://backups.example.com

      # Docker socket proxy alternative for backup hook scripts:
      # 1. Remove/comment the /var/run/docker.sock app volume above.
      # 2. Uncomment the docker-socket-proxy service sample below.
      # 3. Start with: docker compose --profile docker-socket-proxy up -d
      # 4. Uncomment this so hook scripts use the proxy instead of a socket mount.
      # - DOCKER_HOST=tcp://docker-socket-proxy:2375

      # Borg operation timeouts in seconds (uncomment to customize for large repos)
      # Increase these for very large repositories with long cache build times
      # - BORG_INFO_TIMEOUT=600      # borg info operations (default: 10 min)
      # - BORG_LIST_TIMEOUT=600      # borg list operations (default: 10 min)
      # - BORG_INIT_TIMEOUT=300      # borg init operations (default: 5 min)
      # - BORG_EXTRACT_TIMEOUT=3600  # borg extract operations (default: 1 hour)
      # - SCRIPT_TIMEOUT=120         # pre/post backup scripts (default: 2 min)

      # Example for very large repository:
      # - BORG_INFO_TIMEOUT=7200     # 2 hours for initial cache build

      # Local mount points (for file browser detection)
      # Comma-separated list of container paths where host directories are mounted
      # Default: /local (matches the volume mount above)
      # Customize if you change volume mappings (e.g., LOCAL_MOUNT_POINTS=/local,/mylocalserver,/data)
      - LOCAL_MOUNT_POINTS=${LOCAL_MOUNT_POINTS:-/local}

      # Redis cache settings (for 600x faster archive browsing)
      # ⚙️ Configure via Settings → Cache tab in UI (recommended)
      # Environment variables below set initial defaults only
      # See: https://karanhudia.github.io/borg-ui/cache

      # Local Redis connection (uses redis service below)
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - REDIS_DB=0

      # External Redis URL (optional - uncomment to use remote Redis)
      # - REDIS_URL=redis://192.168.1.100:6379/0

      # Cache defaults (override in Settings → Cache UI)
      - CACHE_TTL_SECONDS=7200 # 2 hours
      - CACHE_MAX_SIZE_MB=2048 # 2GB

      # Disable authentication
      # - DISABLE_AUTHENTICATION=true

      # Licensing / activation
      - ACTIVATION_SERVICE_URL=${ACTIVATION_SERVICE_URL:-https://license.borgui.com}
      - ACTIVATION_TIMEOUT_SECONDS=${ACTIVATION_TIMEOUT_SECONDS:-10}
      - ENABLE_STARTUP_LICENSE_SYNC=${ENABLE_STARTUP_LICENSE_SYNC:-true}
    healthcheck:
      test: ["CMD", "sh", "-c", "curl -f http://localhost:$${PORT:-8081}/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

    networks:
      - borg_network

    depends_on:
      redis:
        condition: service_healthy

  redis:
    image: redis:7-alpine
    container_name: borg-redis
    restart: unless-stopped

    command: >
      redis-server
      --maxmemory 2gb
      --maxmemory-policy allkeys-lru
      --save ""
      --appendonly no

    ports:
      - "${REDIS_PORT:-6379}:6379"

    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

    networks:
      - borg_network

  # Uncomment this service to run a Docker socket proxy for backup hook scripts.
  # docker-socket-proxy:
  #   image: ghcr.io/tecnativa/docker-socket-proxy:0.4.2
  #   container_name: borg-docker-socket-proxy
  #   profiles: ["docker-socket-proxy"]
  #   restart: unless-stopped
  #   privileged: true
  #
  #   # Keep this service internal to the Compose network. Do not publish port
  #   # 2375 to the host or internet.
  #   expose:
  #     - "2375"
  #
  #   environment:
  #     # Minimal permissions for typical hook scripts that run docker ps,
  #     # docker stop/start, or docker restart. Disable anything your scripts
  #     # do not need.
  #     - CONTAINERS=1
  #     - INFO=1
  #     - POST=1
  #     - ALLOW_START=1
  #     - ALLOW_STOP=1
  #     - ALLOW_RESTARTS=1
  #
  #   volumes:
  #     - /var/run/docker.sock:/var/run/docker.sock:ro
  #
  #   networks:
  #     - borg_network

networks:
  borg_network:
    driver: bridge

volumes:
  borg_data:
    driver: local
  borg_cache:
    driver: local