name: hobbs-family-organizer

services:
  organizer:
    image: hobbs-family-organizer:1.4.0
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    init: true
    environment:
      NODE_ENV: production
      HOSTNAME: 0.0.0.0
      PORT: "3000"
      TZ: ${ORGANIZER_TIMEZONE:-America/Chicago}
      ORGANIZER_TIMEZONE: ${ORGANIZER_TIMEZONE:-America/Chicago}
      WEATHER_LOCATION: ${WEATHER_LOCATION:-Sapulpa, OK}
      WEATHER_LATITUDE: ${WEATHER_LATITUDE:-35.9987}
      WEATHER_LONGITUDE: ${WEATHER_LONGITUDE:--96.11417}
      NWS_FORECAST_URL: ${NWS_FORECAST_URL:-https://api.weather.gov/gridpoints/TSA/37,98/forecast}
      WEATHER_USER_AGENT: ${WEATHER_USER_AGENT:-Hobbs-Family-Organizer/1.0 (self-hosted)}
      CALENDAR_ICAL_URLS_FILE: /run/secrets/calendar_ical_urls
      ORGANIZER_ACCESS_TOKEN_FILE: /run/secrets/organizer_access_token
      ORGANIZER_DATA_DIR: /data
      ADMIN_ALLOWED_CIDRS: ${ADMIN_ALLOWED_CIDRS:-192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,127.0.0.1/32}
    secrets:
      - calendar_ical_urls
      - organizer_access_token
    ports:
      - "${HOBBS_BIND_ADDRESS:-0.0.0.0}:${HOBBS_HTTP_PORT:-8080}:3000"
    volumes:
      # Admin settings, password hash and history. Must be writable by uid 10001,
      # and must be local disk (not NFS with root_squash).
      - ${HOBBS_DATA_DIR:-./data}:/data
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
      - /app/.next-build/cache:size=128m,uid=10001,gid=10001,mode=0750
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    stop_grace_period: 20s
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"

secrets:
  calendar_ical_urls:
    file: ./secrets/calendar_ical_urls.json
  organizer_access_token:
    file: ./secrets/organizer_access_token.txt