# Production compose — pulls the pre-built image from the Gitea registry.
# The "Deploy on Release" workflow bumps the image tag on this file.
# ALL config comes from a .env next to this file (NOT committed). No secrets here.
services:
  dockhand-backup:
    image: git.tdpi.dev/tdpi/dockhand_backup:v0.1.2
    container_name: dockhand-backup
    restart: unless-stopped
    environment:
      DOCKHAND_URL: "${DOCKHAND_URL}"
      DOCKHAND_USER: "${DOCKHAND_USER}"
      DOCKHAND_PASS: "${DOCKHAND_PASS}"
      DOCKHAND_PROVIDER: "${DOCKHAND_PROVIDER:-local}"
      DOCKHAND_ENV_ID: "${DOCKHAND_ENV_ID}"
      DOCKHAND_VERIFY_TLS: "${DOCKHAND_VERIFY_TLS:-true}"
      FLASK_SECRET_KEY: "${FLASK_SECRET_KEY}"
      OIDC_ISSUER: "${OIDC_ISSUER:-}"
      OIDC_CLIENT_ID: "${OIDC_CLIENT_ID:-}"
      OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET:-}"
      OIDC_REDIRECT_URI: "${OIDC_REDIRECT_URI:-}"
      TZ: "${TZ:-Europe/Berlin}"
    volumes:
      - /mnt/user/backup/docker:/backup
      - /mnt/cache/appdata/backupdocker:/data
      # Mount ONLY the host paths you want backed up, identically mapped.
      # Anything not mounted (or switched off per bind in the UI) is skipped.
      - /mnt/cache/appdata:/mnt/cache/appdata:ro
      - /mnt/docker/appdata:/mnt/docker/appdata:ro
      - /mnt/user/appdata:/mnt/user/appdata:ro
      - /mnt/user/git:/mnt/user/git:ro
    networks:
      - nginx

networks:
  nginx:
    external: true