# A deployment of the KeepOrg server, showing the two things that are easy
# to get wrong: where the master key comes from, and that it does not live
# in the data volume.
#
#   podman-compose up -d      (or docker compose up -d)
#
# Generate the master key once, and keep a copy somewhere safe:
#   head -c 32 /dev/urandom | base64 > master.key
#
# Without it the server still runs and still synchronizes; it only refuses
# to create or merge vaults.

services:
  keeporgd:
    # Override with KEEPORG_VERSION; `make docker` tags the version from
    # versions.mk and :latest.
    image: keeporgd:${KEEPORG_VERSION:-0.3.0}
    build:
      context: ../..
      args:
        VERSION: "${KEEPORG_VERSION:-0.3.0}"
    restart: unless-stopped
    # Terminate TLS in front of this, and set external_url to the address a
    # browser sees: invite links, device approval and the OIDC redirect are
    # built from it.
    command:
      - "-addr=:8765"
      - "-data=/var/lib/keeporg"
      - "-url=https://keeporg.example.com"
    ports:
      - "127.0.0.1:8765:8765"
    environment:
      # Preferred: the key never touches a disk the container can write.
      # Read it from your secret store and pass it in.
      KEEPORG_MASTER_KEY: "${KEEPORG_MASTER_KEY:?set KEEPORG_MASTER_KEY, see the comment above}"
      # Only read on the very first start, when no accounts exist yet.
      KEEPORG_ADMIN_PASSWORD: "${KEEPORG_ADMIN_PASSWORD:-}"
    volumes:
      - keeporg-data:/var/lib/keeporg
      # Only needed instead of KEEPORG_MASTER_KEY above, or to mount a
      # server.json. Keep it on different storage from keeporg-data.
      # - keeporg-config:/etc/keeporg
    # The server writes one directory and needs no privileges at all.
    read_only: true
    cap_drop: ["ALL"]
    security_opt: ["no-new-privileges:true"]
    user: "65532:65532"

volumes:
  keeporg-data:
  # keeporg-config: