services:
  familiar:
    # Pull the image published to Gitea by .gitea/workflows/docker.yml, or build
    # locally with `docker compose build`. Pick the channel via .env:
    # FAMILIAR_IMAGE (:latest / :main for prod, :dev for the dev channel).
    image: ${FAMILIAR_IMAGE:-git.hiddenden.cafe/hiddenden/familiar:latest}
    build:
      context: .
      dockerfile: docker/Dockerfile
    container_name: familiar
    restart: unless-stopped
    env_file:
      - .env
    environment:
      FAMILIAR_HTTP_HOST: 0.0.0.0
      FAMILIAR_HTTP_PORT: "8080"
      FAMILIAR_HTTP_PATH: ${FAMILIAR_HTTP_PATH:-/mcp}
      FAMILIAR_DATA_DIR: /data
      # bearer (default) or oauth. In bearer mode FAMILIAR_HTTP_TOKEN is required.
      FAMILIAR_AUTH_MODE: ${FAMILIAR_AUTH_MODE:-bearer}
      # Bearer token clients send as `Authorization: Bearer <token>`. REQUIRED in
      # bearer mode — `familiar serve` refuses to start on 0.0.0.0 without it
      # (unless FAMILIAR_ALLOW_INSECURE_BIND=true). Leave blank for oauth mode.
      FAMILIAR_HTTP_TOKEN: ${FAMILIAR_HTTP_TOKEN:-}
      # OAuth 2.1 resource-server settings (only used when AUTH_MODE=oauth).
      FAMILIAR_OAUTH_ISSUER: ${FAMILIAR_OAUTH_ISSUER:-}
      FAMILIAR_OAUTH_RESOURCE: ${FAMILIAR_OAUTH_RESOURCE:-}
      FAMILIAR_OAUTH_AUDIENCE: ${FAMILIAR_OAUTH_AUDIENCE:-}
      FAMILIAR_OAUTH_JWKS_URI: ${FAMILIAR_OAUTH_JWKS_URI:-}
      # Writes are off by default over HTTP; set true in .env to allow them.
      FAMILIAR_ENABLE_WRITES: ${FAMILIAR_ENABLE_WRITES:-false}
    # The encrypted token store (token.enc + key), audit log, and write toggle
    # live under /data. Run `familiar login` (or `login --no-browser`) once, then
    # point this at that data dir (or copy token.enc + key into ./data).
    volumes:
      - ${FAMILIAR_DATA_DIR_HOST:-./data}:/data
    # Not published to the host — only reachable on the internal proxy network,
    # where your TLS reverse proxy terminates HTTPS and forwards to :8080.
    expose:
      - "8080"
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    user: "1000:1000"
    networks:
      - proxy
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import httpx; httpx.get('http://127.0.0.1:8080/healthz', timeout=5).raise_for_status()",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    # No proxy labels: Pangolin discovers this service on the shared `proxy`
    # network and forwards to :8080 — configure the route in Pangolin, not here.

networks:
  # Shared reverse-proxy network (Pangolin). Create once with:
  #   docker network create proxy
  proxy:
    external: true