services:
  hub:
    image: git.necloud.us/nate/hub:latest   # built by the Gitea workflow; `docker compose build` builds locally instead
    build: .
    restart: unless-stopped
    # The container looks names up through these. If necloud.us only exists on your home/LAN DNS
    # (Pi-hole, router, AdGuard...), set DNS_1 to that server's IP instead.
    dns:
      - ${DNS_1:-1.1.1.1}
      - ${DNS_2:-8.8.8.8}
    ports:
      - "8080:8080"
    environment:
      # Edit the values here, or leave the ${...} placeholders and set them in a .env file / your stack's env UI.
      SEAFILE_URL: ${SEAFILE_URL:-https://seafile.necloud.us}
      ONLYOFFICE_URL: ${ONLYOFFICE_URL:-https://onlyoffice.necloud.us}
      AUDIOBOOKS_URL: ${AUDIOBOOKS_URL:-https://audiobooks.necloud.us}
      AUDIOBOOKS_LOGIN_LINK: ${AUDIOBOOKS_LOGIN_LINK:-}
      AUDIOBOOKS_SSO_SECRET: ${AUDIOBOOKS_SSO_SECRET:-}
      AUDIOBOOKS_SSO_URL: ${AUDIOBOOKS_SSO_URL:-}
      VERSE_URL: ${VERSE_URL:-https://versebyversewithnate.us/admin}
      WEBMAIL_URL: ${WEBMAIL_URL:-}                         # optional: a webmail elsewhere; leave empty to use the bundled Cypht below
      WEBMAIL_BACKEND_URL: http://cypht:80                   # the bundled webmail (Cypht); the hub shows it at /webmail/ (it is not exposed to the internet)
      CYPHT_USER: ${CYPHT_USER:-hub}                         # the webmail's login; the Mail tab signs in with it for you
      CYPHT_PASSWORD: ${CYPHT_PASSWORD:-}
      PODCAST_URL: ${PODCAST_URL:-https://podcast.necloud.us/}
      ONLYOFFICE_JWT_SECRET: ${ONLYOFFICE_JWT_SECRET:-}    # same value as the OnlyOffice server's JWT secret
      PUBLIC_URL: ${PUBLIC_URL:-}                           # e.g. https://hub.necloud.us (OnlyOffice posts saved edits here)
      HUB_SETUP_CODE: ${HUB_SETUP_CODE:-}                   # first passkey; if empty, a code is printed in the log
      SESSION_DAYS: ${SESSION_DAYS:-180}                     # how long you stay signed in when idle; using the app renews it
      COOKIE_SECRET: ${COOKIE_SECRET:-}                     # optional; auto-generated and kept in /data if empty
    depends_on:
      - cypht
    volumes:
      - hub-data:/data   # passkeys, calendar links and the session secret live here

  # Webmail shown inside the Mail tab (Cypht: several mail accounts in one place). Only the hub can reach it (no published port),
  # so it sits behind the passkey sign-in. Add your accounts once inside it (Gmail, iCloud, Outlook.com, Office365, Yahoo and others are presets).
  cypht:
    image: git.necloud.us/nate/hub-cypht:latest   # built by the Gitea workflow from ./cypht; `docker compose build` builds locally instead
    build: ./cypht
    restart: unless-stopped
    environment:
      AUTH_USERNAME: ${CYPHT_USER:-hub}
      AUTH_PASSWORD: ${CYPHT_PASSWORD:?Choose a password for the webmail and set CYPHT_PASSWORD}   # the hub also uses it to sign you in
      PUBLIC_URL: ${PUBLIC_URL:-}
      # Sign in with Google / Microsoft instead of an app password (optional, see README -> Mail). Leave empty to skip.
      GMAIL_CLIENT_ID: ${GMAIL_CLIENT_ID:-}
      GMAIL_CLIENT_SECRET: ${GMAIL_CLIENT_SECRET:-}
      OUTLOOK_CLIENT_ID: ${OUTLOOK_CLIENT_ID:-}        # personal Outlook.com / Hotmail
      OUTLOOK_CLIENT_SECRET: ${OUTLOOK_CLIENT_SECRET:-}
      OFFICE365_CLIENT_ID: ${OFFICE365_CLIENT_ID:-}    # work or school Microsoft 365
      OFFICE365_CLIENT_SECRET: ${OFFICE365_CLIENT_SECRET:-}
      M365_TENANT: ${M365_TENANT:-}
    volumes:
      - cypht-data:/var/lib/hm3   # the webmail's database: your accounts and settings

volumes:
  hub-data:
    name: nehub-data   # fixed name so the data survives redeploys and renamed stacks
  cypht-data:
    name: nehub-cypht