services:
  squelch:
    image: ghcr.io/revtex/squelch:dev
    # build: .  # uncomment to build locally instead
    ports:
      - "3022:3022"
      # - "3443:3443"  # HTTPS — uncomment with SSL_LISTEN below
    volumes:
      - ./data:/data
    environment:
      ## Core
      - SQUELCH_DB_FILE=/data/squelch.db
      - SQUELCH_RECORDINGS_DIR=/data/recordings
      - SQUELCH_LISTEN=0.0.0.0:3022
      - TZ=America/New_York
      # - SQUELCH_TIMEZONE=America/New_York  # overrides TZ for Squelch only

      ## TLS / HTTPS (pick one option)
      # Option A — your own certificate:
      # - SQUELCH_SSL_LISTEN=0.0.0.0:3443
      # - SQUELCH_SSL_CERT=/data/tls/cert.pem
      # - SQUELCH_SSL_KEY=/data/tls/key.pem
      # Option B — automatic Let's Encrypt:
      # - SQUELCH_SSL_AUTO_CERT=scanner.example.com

      ## Secrets encryption (AES-256-GCM) — recommended
      # Put the key in a .env file next to this docker-compose.yml:
      #   echo "SQUELCH_ENCRYPTION_KEY=$(openssl rand -hex 32)" > .env
      #   chmod 600 .env
      # Compose auto-loads .env and substitutes ${SQUELCH_ENCRYPTION_KEY}.
      # Remember to add .env to .gitignore.
      - SQUELCH_ENCRYPTION_KEY=${SQUELCH_ENCRYPTION_KEY:-}

      ## Admin password reset (remove after first startup)
      # - SQUELCH_ADMIN_PASSWORD=new-password
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3022/api/v1/health"]
      interval: 30s
      timeout: 5s
      start_period: 10s
      retries: 3
    restart: unless-stopped

  # Transcription sidecar (go-whisper).
  # Set transcriptionEnabled=true and transcriptionUrl=http://whisper:8081
  # in Squelch admin settings.
  #
  # Default: CPU-only (most compatible). See GPU examples below.
  whisper:
    image: ghcr.io/mutablelogic/go-whisper
    volumes:
      - whisper-data:/data
    environment:
      - GOWHISPER_DIR=/data
      - GOWHISPER_ADDR=0.0.0.0:8081
    command: ["run"]
    restart: unless-stopped

  # # --- Intel iGPU (UHD 630, Arc, etc.) — Vulkan/OpenCL via /dev/dri ---
  # # NOTE: Vulkan backend may crash with "vk::DeviceLostError" on some drivers.
  # # If you see repeated crashes, use the CPU-only config above instead.
  # # Verify GIDs on your host:  stat -c '%g' /dev/dri/render* /dev/dri/card*
  # whisper:
  #   image: ghcr.io/mutablelogic/go-whisper
  #   volumes:
  #     - whisper-data:/data
  #   devices:
  #     - /dev/dri:/dev/dri
  #   group_add:
  #     - "110"   # render — adjust to match your host GID
  #     - "44"    # video  — adjust to match your host GID
  #   environment:
  #     - GOWHISPER_DIR=/data
  #     - GOWHISPER_ADDR=0.0.0.0:8081
  #   command: ["run"]
  #   restart: unless-stopped

  # # --- NVIDIA GPU example ---
  # whisper:
  #   image: ghcr.io/mutablelogic/go-whisper-cuda
  #   volumes:
  #     - whisper-data:/data
  #   environment:
  #     - GOWHISPER_DIR=/data
  #     - GOWHISPER_ADDR=0.0.0.0:8081
  #   command: ["run"]
  #   deploy:
  #     resources:
  #       reservations:
  #         devices:
  #           - driver: nvidia
  #             count: 1
  #             capabilities: [gpu]
  #   restart: unless-stopped

  # # --- AMD GPU example (ROCm) ---
  # whisper:
  #   image: ghcr.io/mutablelogic/go-whisper
  #   volumes:
  #     - whisper-data:/data
  #   devices:
  #     - /dev/kfd:/dev/kfd
  #     - /dev/dri:/dev/dri
  #   group_add:
  #     - "render"
  #     - "video"
  #   environment:
  #     - GOWHISPER_DIR=/data
  #     - GOWHISPER_ADDR=0.0.0.0:8081
  #   command: ["run"]
  #   restart: unless-stopped

volumes:
  whisper-data: