# ============================================
# SpamEater - Disposable Email Server
# ============================================
# 
# QUICK START:
# 1. Edit hostname (line 28)
# 2. Edit EMAIL_DOMAIN below (line 46)
# 3. Edit WEB_DOMAIN (line 51) (can be main example.com or app.example.com depending on user preference)
# 4. Run: docker compose up -d
# 5. Done!
#
# IMPORTANT: Configure DNS FIRST:
#   MX  example.com       10 mail.example.com
#   A   app.example.com  YOUR_SERVER_IP
#   A   example.com       YOUR_SERVER_IP
# ============================================

services:
  spameater:
    image: ghcr.io/rufftruffles/spameater:latest
    
    container_name: spameater
    
    # ============ EDIT THIS ============
    # Set your domains here or in a .env file beside this compose file
    # (EMAIL_DOMAIN=..., WEB_DOMAIN=...). The migrate-to-docker script
    # writes that .env for you.
    hostname: ${EMAIL_DOMAIN:-example.com}
    # ===================================

    privileged: true  # Required for fail2ban

    ports:
      - "25:25"      # SMTP
      - "80:80"      # HTTP
      - "443:443"    # HTTPS

    volumes:
      - spameater_data:/opt/spameater/data
      - spameater_logs:/opt/spameater/logs
      - letsencrypt_certs:/etc/letsencrypt

    environment:
      # Values come from the shell / a .env file; defaults keep the
      # first-run example working when nothing is set.
      EMAIL_DOMAIN: ${EMAIL_DOMAIN:-example.com}
      WEB_DOMAIN: ${WEB_DOMAIN:-app.example.com}
      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
      
      # ============ SECRETS ============
      # Generated on first start and persisted on the data volume, so
      # upgrades and recreates keep the same encryption key. Do NOT wire these
      # to a .env file: a short/placeholder value would overwrite the good
      # persisted key and make stored mail undecryptable. To supply your own,
      # uncomment and set a real 32+ char value here directly:
      # DELETE_TOKEN_SECRET: "your-32-char-secret"
      # CSRF_SECRET: "your-32-char-secret"
      # ENCRYPTION_KEY: "your-32-char-secret"


      # ============ ADVANCED ============
      # Disable SSL (for testing only, set to "true")
      DISABLE_SSL: "false"
      
      # Disable automatic SSL certificate generation
      AUTO_SSL: "true"
    
    restart: unless-stopped
    
    networks:
      - spameater_network
    
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

volumes:
  spameater_data:
    driver: local
      
  spameater_logs:
    driver: local
      
  letsencrypt_certs:
    driver: local

networks:
  spameater_network:
    driver: bridge