services:
  squelch:
    image: ghcr.io/revtex/squelch:dev
    # build: .  # uncomment to build locally instead
    ports:
      - "3022:3022"
      # - "3443:3443"  # HTTPS — uncomment with SSL_LISTEN below
    volumes:
      - ./data:/data
    environment:
      ## Core
      - SQUELCH_DB_FILE=/data/squelch.db
      - SQUELCH_RECORDINGS_DIR=/data/recordings
      - SQUELCH_LISTEN=0.0.0.0:3022
      - TZ=America/New_York
      # - SQUELCH_TIMEZONE=America/New_York  # overrides TZ for Squelch only

      ## TLS / HTTPS (pick one option)
      # Option A — your own certificate:
      # - SQUELCH_SSL_LISTEN=0.0.0.0:3443
      # - SQUELCH_SSL_CERT=/data/tls/cert.pem
      # - SQUELCH_SSL_KEY=/data/tls/key.pem
      # Option B — automatic Let's Encrypt:
      # - SQUELCH_SSL_AUTO_CERT=scanner.example.com

      ## Secrets encryption (AES-256-GCM)
      # Generate a key:  openssl rand -hex 32
      # - SQUELCH_ENCRYPTION_KEY=your-key-here
      # Or read it from a file. Squelch runs as uid/gid 1001, so the file
      # must be group-readable by it or the container will restart-loop:
      #   chown $USER:1001 key && chmod 640 key
      # - SQUELCH_ENCRYPTION_KEY_FILE=/run/secrets/encryption_key

      ## Admin password reset (remove after first startup)
      # - SQUELCH_ADMIN_PASSWORD=new-password
    # secrets:
    #   - encryption_key
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3022/api/v1/health"]
      interval: 30s
      timeout: 5s
      start_period: 10s
      retries: 3
    restart: unless-stopped

  ## Optional bundled MQTT broker for the Trunk Recorder integration.
  ## Activate with:  docker compose --profile mqtt up -d
  ##
  ## On first start, ./mosquitto/config/mosquitto.conf is generated bound
  ## to 127.0.0.1:1883 with password authentication required. Add users
  ## with:
  ##   docker compose exec mosquitto mosquitto_passwd /mosquitto/config/passwd <user>
  ## To expose the broker to the LAN, change the published port mapping
  ## below to "0.0.0.0:1883:1883" and set listener 0.0.0.0 in the conf.
  mosquitto:
    image: eclipse-mosquitto:2
    profiles: ["mqtt"]
    restart: unless-stopped
    ports:
      - "127.0.0.1:1883:1883"
    volumes:
      - ./mosquitto/config:/mosquitto/config
      - ./mosquitto/data:/mosquitto/data
    entrypoint:
      - sh
      - -c
      - |
        set -e
        CONF=/mosquitto/config/mosquitto.conf
        if [ ! -f "$$CONF" ]; then
          echo "[init] writing default mosquitto.conf"
          mkdir -p /mosquitto/config /mosquitto/data
          cat > "$$CONF" <<'EOF'
        # Default Squelch-bundled mosquitto config.
        # Ships with anonymous access so the broker boots cleanly on a
        # fresh checkout. Lock it down after creating a user with
        # `mosquitto_passwd` (see docs/tr-mqtt-guide.md).
        listener 1883 0.0.0.0
        allow_anonymous true
        #allow_anonymous false
        #password_file /mosquitto/config/passwd
        persistence true
        persistence_location /mosquitto/data/
        log_dest stdout
        EOF
        fi
        # The passwd file is NOT auto-created. Run mosquitto_passwd inside
        # the container after first boot. `--user mosquitto` is required
        # so the file is owned by UID 1883 with 0700 perms (mosquitto 2.x
        # refuses files with looser perms or wrong ownership):
        #
        #   docker compose exec --user mosquitto mosquitto \
        #     mosquitto_passwd -c -b /mosquitto/config/passwd <user> <password>
        #   docker compose restart mosquitto
        exec /docker-entrypoint.sh /usr/sbin/mosquitto -c "$$CONF"

# secrets:
#   encryption_key:
#     file: ./encryption_key.txt