version: '3.8'

services:
  nfoguard:
    # image: ghcr.io/sbcrumb/nfoguard:latest  # Use this once package is public
    build: .  # Temporary local build
    container_name: nfoguard
    restart: unless-stopped
    user: "1000:1000"
    networks:
      - saltbox  
    ports:
      - "8085:8080"
    volumes:
      # Media directory
      - /mnt/unionfs/Media/:/media:rw
      
      # NFOGuard data directory for database and logs
      - ./data:/app/data:rw
      
      # Configuration files (SECURE TWO-FILE SYSTEM)
      - ./.env:/app/.env:ro              # Main config (safe to share)
      - ./.env.secrets:/app/.env.secrets:ro  # API keys & passwords (never commit)
    
    # Optional: Can use env_file for simple setups, but file mounting is more secure
    # env_file:
    #   - .env
    #   - .env.secrets
    
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

networks:
  saltbox:
    external: true