# Church key register
#
# One container, one SQLite file. Access comes from Tailscale, not from
# opening a port to the network.

services:
  keyreg:
    # Build locally, or point IMAGE at a registry copy and drop `build:`
    # entirely — the image is self-contained and needs no source tree.
    #   IMAGE=ghcr.io/you/keyreg:1.0 docker compose up -d
    build: .
    image: ${IMAGE:-keyreg:local}
    container_name: keyreg
    restart: unless-stopped
    environment:
      TZ: ${TZ:-Europe/Lisbon}
      # Interface language: pt (Portugal) or en.
      UI_LANG: ${UI_LANG:-pt}
      # Optional shared passcode. Leave empty and there is no gate at all —
      # correct when only your Tailscale devices can reach this.
      ACCESS_CODE: ${ACCESS_CODE:-}
      # Reverse proxies in front (1 = NPM, 2 = Cloudflare + NPM). Empty = none.
      TRUST_PROXY: ${TRUST_PROXY:-}
      # Shared PIN for the /pedido request form.
      REQUEST_PIN: ${REQUEST_PIN:-}
      # 1 = /pedido bypasses ACCESS_CODE so outsiders can submit. See README.
      PUBLIC_REQUESTS: ${PUBLIC_REQUESTS:-0}
      # Set to 1 for the very first run if you want sample data to click around.
      # Turn it back to 0 before entering anything real.
      SEED_DEMO: ${SEED_DEMO:-0}
    volumes:
      # A named volume, not a bind mount. SQLite in WAL mode needs shared
      # memory mapping, which Docker Desktop's file sharing on macOS and
      # Windows does not support — a bind mount there fails to open the
      # database, or corrupts it later. This works the same everywhere.
      - keyreg_data:/data
    ports:
      # Localhost only. `tailscale serve --bg 3000` puts HTTPS in front.
      # Change to "3000:3000" ONLY for temporary testing on your own LAN.
      #
      # ON A VPS WITH NGINX PROXY MANAGER: delete this whole `ports:` block and
      # uncomment `networks:` below. NPM then reaches the app by container name
      # over the shared Docker network, and nothing at all listens on the public
      # interface — not even on localhost, where any other user on the box could
      # curl it.
      - "127.0.0.1:3000:3000"

    # networks:
    #   - npm

# networks:
#   npm:
#     external: true
#     # The network NPM already runs on. Find it with:
#     #   docker network ls
#     #   docker inspect <npm-container> -f '{{json .NetworkSettings.Networks}}'
#     name: CHANGEME_npm_default

volumes:
  keyreg_data: