services:
  app:
    # Pulls the prebuilt image published by CI — no clone or local build needed.
    # To build from source instead, comment out `image:` and uncomment `build: .`.
    image: ghcr.io/largerio/secret:1
    # build: .
    ports:
      - "${PORT:-3000}:3000"
    volumes:
      - secret-data:/app/data
    environment:
      - DATABASE_PATH=/app/data/secret.db
      - FILES_PATH=/app/data/files
      # Leave unset to auto-generate a key on first launch (persisted in the volume).
      - SERVER_ENCRYPTION_KEY=${SERVER_ENCRYPTION_KEY:-}
      # Or a file that holds it: see docs/self-hosting.md#secrets-in-files.
      - SERVER_ENCRYPTION_KEY_FILE=${SERVER_ENCRYPTION_KEY_FILE:-}
      - APP_URL=${APP_URL:-http://localhost:3000}
      - APP_NAME=${APP_NAME:-Secret}
      # Unset, each language keeps its own description of the home page.
      - APP_DESCRIPTION=${APP_DESCRIPTION:-}
      - APP_PRIMARY_COLOR=${APP_PRIMARY_COLOR:-}
      - APP_FOOTER_TEXT=${APP_FOOTER_TEXT:-}
      - APP_OG_IMAGE_URL=${APP_OG_IMAGE_URL:-}
      - MAX_FILE_SIZE=${MAX_FILE_SIZE:-10485760}
      - MAX_FILES_PER_NOTE=${MAX_FILES_PER_NOTE:-10}
      - MAX_EXPIRY=${MAX_EXPIRY:-2592000}
      - STORAGE_QUOTA_BYTES=${STORAGE_QUOTA_BYTES:-0}
      - CHUNK_SIZE=${CHUNK_SIZE:-4194304}
      - MAX_CHUNKED_FILE_SIZE=${MAX_CHUNKED_FILE_SIZE:-524288000}
      - STORAGE_BACKEND=${STORAGE_BACKEND:-local}
      - S3_BUCKET=${S3_BUCKET:-}
      - S3_REGION=${S3_REGION:-us-east-1}
      - S3_ENDPOINT=${S3_ENDPOINT:-}
      - S3_ACCESS_KEY_ID=${S3_ACCESS_KEY_ID:-}
      - S3_SECRET_ACCESS_KEY=${S3_SECRET_ACCESS_KEY:-}
      - S3_ACCESS_KEY_ID_FILE=${S3_ACCESS_KEY_ID_FILE:-}
      - S3_SECRET_ACCESS_KEY_FILE=${S3_SECRET_ACCESS_KEY_FILE:-}
      - S3_FORCE_PATH_STYLE=${S3_FORCE_PATH_STYLE:-false}
      - STORAGE_RECONCILE=${STORAGE_RECONCILE:-true}
      - API_KEY=${API_KEY:-}
      - API_KEY_1=${API_KEY_1:-}
      - API_KEY_2=${API_KEY_2:-}
      - API_KEY_3=${API_KEY_3:-}
      - API_KEY_FILE=${API_KEY_FILE:-}
      - API_KEY_1_FILE=${API_KEY_1_FILE:-}
      - API_KEY_2_FILE=${API_KEY_2_FILE:-}
      - API_KEY_3_FILE=${API_KEY_3_FILE:-}
      - CAP_DIFFICULTY=${CAP_DIFFICULTY:-4}
      - CAP_CHALLENGE_COUNT=${CAP_CHALLENGE_COUNT:-50}
      # Behind a reverse proxy, rate limits only tell clients apart once
      # ADDRESS_HEADER and XFF_DEPTH are set. See
      # docs/self-hosting.md#making-rate-limiting-work-behind-a-proxy
      - TRUSTED_PROXIES=${TRUSTED_PROXIES:-}
      - ADDRESS_HEADER=${ADDRESS_HEADER:-}
      - XFF_DEPTH=${XFF_DEPTH:-1}
      - RATE_LIMIT_MULTIPLIER=${RATE_LIMIT_MULTIPLIER:-1}
      - ALLOW_SERVER_KEY_CHANGE=${ALLOW_SERVER_KEY_CHANGE:-false}
      - CLEANUP_INTERVAL_MS=${CLEANUP_INTERVAL_MS:-300000}
      # Turns on /api/metrics. See docs/self-hosting.md#monitoring
      - METRICS_TOKEN=${METRICS_TOKEN:-}
      - METRICS_TOKEN_FILE=${METRICS_TOKEN_FILE:-}
      # Raise it with a stop_grace_period a couple of seconds longer.
      - SHUTDOWN_TIMEOUT=${SHUTDOWN_TIMEOUT:-}
      - DEBUG=${DEBUG:-0}
    restart: unless-stopped
    init: true
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true

volumes:
  secret-data: