# Example deployment. Put a TLS-terminating reverse proxy in front (see README).
services:
  ratatoskr:
    image: ghcr.io/OWNER/ratatoskr:latest   # replace OWNER, or build locally with `build: .`
    restart: unless-stopped
    ports:
      - "127.0.0.1:8080:8080"
    environment:
      RATATOSKR_BASE_URL: https://mail.example.com
      RATATOSKR_SECRET_KEY: ${RATATOSKR_SECRET_KEY:?set RATATOSKR_SECRET_KEY in .env}
      RATATOSKR_TRUST_PROXY: "true"
      OIDC_ISSUER_URL: https://auth.example.com/application/o/ratatoskr/
      OIDC_CLIENT_ID: ratatoskr
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:?set OIDC_CLIENT_SECRET in .env}
      # OIDC_LABEL: Authentik
      # Also allow username/password login next to OIDC (it's the default without OIDC_*):
      # RATATOSKR_PASSWORD_LOGIN: "true"
      # RATATOSKR_REGISTRATION: first   # open | first | closed
      # User and group that run the server and own /data (default 1000:1000):
      # PUID: "1000"
      # PGID: "1000"
    volumes:
      - ratatoskr-data:/data

volumes:
  ratatoskr-data: