services:
  hub:
    image: git.necloud.us/nate/hub:latest   # built by the Gitea workflow; `docker compose build` builds locally instead
    build: .
    restart: unless-stopped
    # The container looks names up through these. If necloud.us only exists on your home/LAN DNS
    # (Pi-hole, router, AdGuard...), set DNS_1 to that server's IP instead.
    dns:
      - ${DNS_1:-1.1.1.1}
      - ${DNS_2:-8.8.8.8}
    ports:
      - "8080:8080"
    environment:
      # Edit the values here, or leave the ${...} placeholders and set them in a .env file / your stack's env UI.
      SEAFILE_URL: ${SEAFILE_URL:-https://seafile.necloud.us}
      ONLYOFFICE_URL: ${ONLYOFFICE_URL:-https://onlyoffice.necloud.us}
      AUDIOBOOKS_URL: ${AUDIOBOOKS_URL:-https://audiobooks.necloud.us}
      AUDIOBOOKS_LOGIN_LINK: ${AUDIOBOOKS_LOGIN_LINK:-}
      AUDIOBOOKS_SSO_SECRET: ${AUDIOBOOKS_SSO_SECRET:-}
      AUDIOBOOKS_SSO_URL: ${AUDIOBOOKS_SSO_URL:-}
      VERSE_URL: ${VERSE_URL:-https://versebyversewithnate.us/admin}
      WEBMAIL_URL: ${WEBMAIL_URL:-}                         # optional: a webmail elsewhere; leave empty to use the bundled Cypht below
      WEBMAIL_BACKEND_URL: http://127.0.0.1:80               # the bundled webmail (Cypht, below, shares this container's network); the hub shows it at /webmail/
      CYPHT_USER: ${CYPHT_USER:-hub}                         # the webmail's login; the Mail tab signs in with it for you
      CYPHT_PASSWORD: ${CYPHT_PASSWORD:-}
      SIGNAL_API_URL: http://127.0.0.1:8085                  # the bundled Signal bridge (below, shares this container's network); remove this line and the service to skip Signal
      PODCAST_URL: ${PODCAST_URL:-https://podcast.necloud.us/}
      ONLYOFFICE_JWT_SECRET: ${ONLYOFFICE_JWT_SECRET:-}    # same value as the OnlyOffice server's JWT secret
      PUBLIC_URL: ${PUBLIC_URL:-}                           # e.g. https://hub.necloud.us (OnlyOffice posts saved edits here)
      HUB_SETUP_CODE: ${HUB_SETUP_CODE:-}                   # first passkey; if empty, a code is printed in the log
      SESSION_DAYS: ${SESSION_DAYS:-180}                     # how long you stay signed in when idle; using the app renews it
      COOKIE_SECRET: ${COOKIE_SECRET:-}                     # optional; auto-generated and kept in /data if empty
    volumes:
      - hub-data:/data   # passkeys, calendar links and the session secret live here

  # Webmail shown inside the Mail tab (Cypht: several mail accounts in one place). Only the hub can reach it (no published port),
  # so it sits behind the passkey sign-in. Add your accounts once inside it (Gmail, iCloud, Outlook.com, Office365, Yahoo and others are presets).
  cypht:
    image: git.necloud.us/nate/hub-cypht:latest   # built by the Gitea workflow from ./cypht; `docker compose build` builds locally instead
    build: ./cypht
    restart: unless-stopped
    # Shares the hub's network, so the hub reaches it at 127.0.0.1 whatever network mode or DNS the host uses, and nothing else can reach it.
    network_mode: "service:hub"
    depends_on:
      - hub
    environment:
      AUTH_USERNAME: ${CYPHT_USER:-hub}
      AUTH_PASSWORD: ${CYPHT_PASSWORD:?Choose a password for the webmail and set CYPHT_PASSWORD}   # the hub also uses it to sign you in
      PUBLIC_URL: ${PUBLIC_URL:-}
      # Sign in with Google / Microsoft instead of an app password (optional, see README -> Mail). Leave empty to skip.
      GMAIL_CLIENT_ID: ${GMAIL_CLIENT_ID:-}
      GMAIL_CLIENT_SECRET: ${GMAIL_CLIENT_SECRET:-}
      OUTLOOK_CLIENT_ID: ${OUTLOOK_CLIENT_ID:-}        # personal Outlook.com / Hotmail
      OUTLOOK_CLIENT_SECRET: ${OUTLOOK_CLIENT_SECRET:-}
      OFFICE365_CLIENT_ID: ${OFFICE365_CLIENT_ID:-}    # work or school Microsoft 365
      OFFICE365_CLIENT_SECRET: ${OFFICE365_CLIENT_SECRET:-}
      M365_TENANT: ${M365_TENANT:-}
    volumes:
      - cypht-data:/var/lib/hm3   # the webmail's database: your accounts and settings

  # Signal messages (the Signal tab). This links to your Signal account as one more linked device (like Signal Desktop) through the community
  # signal-cli-rest-api bridge. Not an official Signal product; its link to your account (keys) is kept in the signal-data volume. See README -> Signal.
  signal:
    image: bbernhard/signal-cli-rest-api:0.101
    restart: unless-stopped
    network_mode: "service:hub"       # reached by the hub at 127.0.0.1:8085 and by nothing else
    depends_on:
      - hub
    environment:
      MODE: json-rpc
      PORT: "8085"
    volumes:
      - signal-data:/home/.local/share/signal-cli

volumes:
  hub-data:
    name: nehub-data   # fixed name so the data survives redeploys and renamed stacks
  cypht-data:
    name: nehub-cypht
  signal-data:
    name: nehub-signal