# GWS Backup — Docker Compose
#
#   1. cp .env.example .env
#   2. Generate the two secrets it asks for (the file tells you how)
#   3. docker compose up -d
#
# To update later:
#
#   docker compose pull && docker compose up -d
#
# Your data lives in a Docker volume, not in the image, so it is untouched by an
# update. See the volumes section below.
#
# The `version:` key that used to head this file was removed: Compose V2 ignores
# it and warns about it.

services:
  gws-backup:
    # Pulled from GitHub's container registry — nothing to build, and nothing to
    # download from the website except this file.
    #
    # The address is baked into every copy of this file customers keep, so it is
    # not a thing to change casually: moving registries later would leave every
    # existing install pointing at somewhere dead. Same trap as a payment URL
    # compiled into a shipped binary.
    image: ghcr.io/kikosolutions-tech/gwsbackup:0.96
    container_name: gws-backup
    restart: unless-stopped

    ports:
      - "${GWSB_PORT:-3000}:3000"

    volumes:
      # A NAMED volume, not ./data.
      #
      # The container runs as the unprivileged `node` user (uid 1000). Docker
      # copies the image's ownership into a named volume when it first creates
      # it, so /app/data arrives writable. A host bind mount does not get that
      # treatment — it keeps the host directory's ownership, and on most hosts
      # the container then cannot write, which surfaces as SQLITE_READONLY
      # rather than as anything mentioning permissions.
      #
      # To keep the data somewhere you can see it, replace this with a bind
      # mount AND chown the directory to uid 1000 on the host first.
      - gwsbackup-data:/app/data

    environment:
      NODE_ENV: production
      PORT: 3000

      # Database, and therefore also the per-client indexes in data/clients.
      DATABASE_URL: file:/app/data/gws-backup.db

      # ── Required. The container refuses to start without these ──────────────
      #
      # Both MUST be supplied rather than generated inside the container.
      # Anything the application generates lands in /app/.env, which is not in
      # the volume, so it would be minted fresh on every container — and a new
      # ENCRYPTION_KEY orphans every stored credential at once. The application
      # has a guard that refuses to boot in that situation rather than destroy
      # anything, so getting this wrong shows up as a container that will not
      # start. Set them once, keep them somewhere safe, never change
      # ENCRYPTION_KEY on a live install.
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:?set ENCRYPTION_KEY in .env — see .env.example}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:?set NEXTAUTH_SECRET in .env — see .env.example}

      # ── Recommended ────────────────────────────────────────────────────────
      # The public https:// address of this console. Google Drive OAuth
      # callbacks return here, so connecting a client fails without it unless
      # you are reaching the console directly on its own address.
      NEXTAUTH_URL: ${NEXTAUTH_URL:-}

      # Only if you were given a different licence server address. The build has
      # the default compiled in.
      LICENSE_SERVER_URL: ${LICENSE_SERVER_URL:-}

    # Backups are long-running network jobs; give the process time to finish
    # writing rather than killing it mid-index-write.
    stop_grace_period: 30s

volumes:
  gwsbackup-data:
