services:
  starpunk:
    image: git.thesatelliteoflove.com/phil/starpunk:v2.0.1
    container_name: starpunk
    restart: unless-stopped
    extra_hosts:
      - '{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}'
      - '{{ primary_domain }}:{{ docker.hairpin_ip }}'
    volumes:
      - starpunk-data:/data
    environment:
      # Site configuration
      SITE_URL: https://{{ subdomains.starpunk }}
      SITE_NAME: StarPunk
      SITE_AUTHOR: Mr Whiskers
      SITE_DESCRIPTION: Starpunk instance
      # Site owner identity (h-card source, Micropub "me")
      ADMIN_ME: https://{{ primary_domain }}
      SESSION_SECRET: {{ vault_starpunk.session_secret }}
      # Admin login via Pocket ID (client "StarPunk"); only this user may log in.
      # StarPunk issues Micropub tokens itself (ADR-064).
      OIDC_ISSUER: https://{{ subdomains.pocketid }}
      OIDC_CLIENT_ID: {{ vault_starpunk.pocketid.client_id }}
      OIDC_CLIENT_SECRET: {{ vault_starpunk.pocketid.client_secret }}
      OIDC_ADMIN_SUB: {{ starpunk_admin_sub }}
      OIDC_PROVIDER_NAME: Pocket ID
      # Production settings
      FLASK_ENV: production
      FLASK_DEBUG: 0
      LOG_LEVEL: INFO
      DEV_MODE: false
volumes:
  # Existing volume (starpunk_starpunk-data) holds the posts and database
  starpunk-data:
networks:
  default:
    external: true
    name: {{ docker.network_name }}