name: itworx-knowledge-hub

# Every writable volume is a host bind mount below KNOWLEDGE_HUB_APPDATA_ROOT,
# defaulting to the project-local ./.local-appdata directory. Keep this storage model
# stable during upgrades: changing a populated deployment to fresh named volumes can
# make the application appear to have lost data even though the original bind-mounted
# files still exist. Back up and test restore before changing volume mappings.

services:
  db:
    image: postgres:18.4-bookworm@sha256:882236b897e39051d2368c5ccc6cda944904723506b2dfc97f2a8f5bc9afa382
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-knowledge_hub}
      POSTGRES_USER: ${POSTGRES_USER:-knowledge_hub}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in the deployment environment}
      TZ: ${TZ:-Europe/Brussels}
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}"
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s
    volumes:
      - ${KNOWLEDGE_HUB_APPDATA_ROOT:-./.local-appdata}/postgres:/var/lib/postgresql
    networks:
      - knowledge-hub-internal
    security_opt:
      - no-new-privileges:true

  app:
    image: ${KNOWLEDGE_HUB_IMAGE:-itworx/knowledge-hub:local}
    build:
      context: .
      dockerfile: deploy/docker/Dockerfile
      args:
        BUILD_COMMIT: ${BUILD_COMMIT:-development}
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      ASPNETCORE_ENVIRONMENT: ${ASPNETCORE_ENVIRONMENT:-Production}
      ASPNETCORE_URLS: http://0.0.0.0:8080
      KnowledgeHub__Database__Host: db
      KnowledgeHub__Database__Port: "5432"
      KnowledgeHub__Database__Name: ${POSTGRES_DB:-knowledge_hub}
      KnowledgeHub__Database__Username: ${POSTGRES_USER:-knowledge_hub}
      KnowledgeHub__Database__Password: "${POSTGRES_PASSWORD}"
      KnowledgeHub__Database__IncludeErrorDetail: "false"
      KnowledgeHub__BaseUrl: ${KNOWLEDGE_HUB_BASE_URL:-http://localhost:1240}
      AllowedHosts: "${KNOWLEDGE_HUB_ALLOWED_HOSTS:-localhost;127.0.0.1;[::1]}"
      # Semicolon-delimited IPs of reverse proxies allowed to set X-Forwarded-For/-Proto
      # (docs/23-deployment-unraid.md "Reverse proxy"). Left empty, forwarded headers from
      # any source are ignored and every cookie is issued as if the request were plain HTTP.
      KnowledgeHub__TrustedProxies: "${KNOWLEDGE_HUB_TRUSTED_PROXIES:-}"
      KnowledgeHub__PrimaryLocale: ${DEFAULT_LOCALE:-nl-BE}
      KnowledgeHub__TimeZone: ${TZ:-Europe/Brussels}
      KnowledgeHub__Paths__Data: /var/lib/knowledge-hub/data
      KnowledgeHub__Paths__Attachments: /var/lib/knowledge-hub/attachments
      KnowledgeHub__Paths__Imports: /var/lib/knowledge-hub/imports
      KnowledgeHub__Paths__Exports: /var/lib/knowledge-hub/exports
      KnowledgeHub__Paths__Backups: /var/lib/knowledge-hub/backups
      KnowledgeHub__Paths__Keys: /var/lib/knowledge-hub/keys
      Build__Commit: ${BUILD_COMMIT:-development}
      TZ: ${TZ:-Europe/Brussels}
    ports:
      - "${KNOWLEDGE_HUB_PORT:-1240}:8080"
    healthcheck:
      test:
        - CMD
        - curl
        - --fail
        - --silent
        - --show-error
        - http://127.0.0.1:8080/health/live
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 30s
    volumes:
      - ${KNOWLEDGE_HUB_APPDATA_ROOT:-./.local-appdata}/data:/var/lib/knowledge-hub/data
      - ${KNOWLEDGE_HUB_APPDATA_ROOT:-./.local-appdata}/attachments:/var/lib/knowledge-hub/attachments
      - ${KNOWLEDGE_HUB_APPDATA_ROOT:-./.local-appdata}/imports:/var/lib/knowledge-hub/imports
      - ${KNOWLEDGE_HUB_APPDATA_ROOT:-./.local-appdata}/exports:/var/lib/knowledge-hub/exports
      - ${KNOWLEDGE_HUB_APPDATA_ROOT:-./.local-appdata}/backups:/var/lib/knowledge-hub/backups
      - ${KNOWLEDGE_HUB_APPDATA_ROOT:-./.local-appdata}/keys:/var/lib/knowledge-hub/keys
    tmpfs:
      - /tmp:size=256m,mode=1770,uid=10001,gid=10001
    read_only: true
    user: "10001:10001"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    networks:
      - knowledge-hub-internal
      - knowledge-hub-edge

networks:
  knowledge-hub-internal:
    internal: true
  knowledge-hub-edge: