services:
  hub:
    image: git.necloud.us/nate/hub:latest   # built by the Gitea workflow; `docker compose build` builds locally instead
    build: .
    restart: unless-stopped
    # The container looks names up through these. If necloud.us only exists on your home/LAN DNS
    # (Pi-hole, router, AdGuard...), set DNS_1 to that server's IP instead.
    dns:
      - ${DNS_1:-1.1.1.1}
      - ${DNS_2:-8.8.8.8}
    ports:
      - "8080:8080"
    environment:
      # Edit the values here, or leave the ${...} placeholders and set them in a .env file / your stack's env UI.
      SEAFILE_URL: ${SEAFILE_URL:-https://seafile.necloud.us}
      ONLYOFFICE_URL: ${ONLYOFFICE_URL:-https://onlyoffice.necloud.us}
      AUDIOBOOKS_URL: ${AUDIOBOOKS_URL:-https://audiobooks.necloud.us}
      AUDIOBOOKS_LOGIN_LINK: ${AUDIOBOOKS_LOGIN_LINK:-}
      AUDIOBOOKS_SSO_SECRET: ${AUDIOBOOKS_SSO_SECRET:-}
      AUDIOBOOKS_SSO_URL: ${AUDIOBOOKS_SSO_URL:-}
      VERSE_URL: ${VERSE_URL:-https://versebyversewithnate.us/admin}
      WEBMAIL_URL: ${WEBMAIL_URL:-}                         # optional: a webmail elsewhere; leave empty to use the bundled Roundcube below
      ROUNDCUBE_URL: http://roundcube:80                     # the bundled Roundcube; the hub shows it at /webmail/ (it is not exposed to the internet)
      PODCAST_URL: ${PODCAST_URL:-https://podcast.necloud.us/}
      ONLYOFFICE_JWT_SECRET: ${ONLYOFFICE_JWT_SECRET:-}    # same value as the OnlyOffice server's JWT secret
      PUBLIC_URL: ${PUBLIC_URL:-}                           # e.g. https://hub.necloud.us (OnlyOffice posts saved edits here)
      HUB_SETUP_CODE: ${HUB_SETUP_CODE:-}                   # first passkey; if empty, a code is printed in the log
      SESSION_DAYS: ${SESSION_DAYS:-180}                     # how long you stay signed in when idle; using the app renews it
      COOKIE_SECRET: ${COOKIE_SECRET:-}                     # optional; auto-generated and kept in /data if empty
    depends_on:
      - roundcube
    volumes:
      - hub-data:/data   # passkeys, calendar links and the session secret live here

  # Webmail shown inside the Mail tab. Only the hub can reach it (no published port), so it sits behind the passkey sign-in.
  # Sign in to it with your mail address and an app password (Gmail, iCloud and Yahoo are preset in roundcube/hub.php).
  roundcube:
    image: git.necloud.us/nate/hub-roundcube:latest   # built by the Gitea workflow from ./roundcube; `docker compose build` builds locally instead
    build: ./roundcube
    restart: unless-stopped
    environment:
      # Microsoft 365 sign-in (optional, see README -> Mail). Leave empty to skip.
      M365_CLIENT_ID: ${M365_CLIENT_ID:-}
      M365_CLIENT_SECRET: ${M365_CLIENT_SECRET:-}
      M365_TENANT: ${M365_TENANT:-}
      PUBLIC_URL: ${PUBLIC_URL:-}
    volumes:
      - roundcube-data:/var/roundcube/db   # address book, settings and the encryption key

volumes:
  hub-data:
    name: nehub-data   # fixed name so the data survives redeploys and renamed stacks
  roundcube-data:
    name: nehub-roundcube