# Sneaky Klaus - Example Docker Compose Configuration
#
# Copy this file to docker-compose.yml and customize for your environment.
#
# Quick Start:
#   1. cp docker-compose.example.yml docker-compose.yml
#   2. Create .env file with your configuration (see .env.example)
#   3. docker compose up -d
#   4. Visit http://localhost:8000 to set up your admin account
#
# Upgrading:
#   docker compose pull
#   docker compose up -d
#   (Migrations run automatically on container start)

version: "3.8"

services:
  sneaky-klaus:
    image: git.thesatelliteoflove.com/phil/sneakyklaus:latest
    container_name: sneaky-klaus
    restart: unless-stopped
    ports:
      - "8000:8000"
    environment:
      # Required: Generate a secure secret key
      # Example: python -c "import secrets; print(secrets.token_hex(32))"
      - SECRET_KEY=${SECRET_KEY:?SECRET_KEY is required}

      # Required for production email sending via Resend
      # Get your API key at https://resend.com
      - RESEND_API_KEY=${RESEND_API_KEY:-}

      # Email sender address (must be verified domain with Resend)
      - EMAIL_FROM=${EMAIL_FROM:-noreply@example.com}

      # Public URL of your application (used in magic link emails)
      - APP_URL=${APP_URL:-http://localhost:8000}

      # Environment: 'production' or 'development'
      # In development mode, emails are logged to stdout instead of sent
      - FLASK_ENV=${FLASK_ENV:-production}
    volumes:
      # Persistent storage for SQLite database and session files
      # Database migrations are applied automatically on container start
      - sneaky-klaus-data:/app/data
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

volumes:
  sneaky-klaus-data:
    driver: local

# Optional: Add a reverse proxy for HTTPS
# Example with Traefik:
#
# services:
#   sneaky-klaus:
#     labels:
#       - "traefik.enable=true"
#       - "traefik.http.routers.sneaky-klaus.rule=Host(`secretsanta.example.com`)"
#       - "traefik.http.routers.sneaky-klaus.tls.certresolver=letsencrypt"
#     networks:
#       - traefik
#
# networks:
#   traefik:
#     external: true