# Komga - Képregény és manga szerver OPDS támogatással
# Domain: ${SUBDOMAIN}.${DOMAIN}
# Database: None (file-based)
# RAM: ~200M (mem_limit: 512M) | Pi-compatible: Yes
#
# Environment variables:
#   DOMAIN          - Your domain (e.g., demo-felhom.eu)
#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
#
# Storage layout (felhom userdata convention):
#   Képregénytár → ${USERDATA_PATH}/media/comics   (írható)
# Run-identity: ROOT (fallback). user "1000:1000" was tried but the gotson/komga image creates its
# SQLite /config DB as root at init and cannot open it when pinned to 1000 (no PUID-style chown) —
# the container crash-loops. So it runs as root and relies on the setgid 2775 userdata dirs: files it
# writes land group 1000 so FileBrowser + group members can READ/browse them. (Verified live; see REPORT.)

services:
  komga:
    image: gotson/komga:1.20.0
    container_name: komga
    restart: unless-stopped
    # Runs as root (see note above). Restore an escalation boundary: block SUID-based privilege
    # escalation. Full cap_drop is NOT applied — the image's root-init needs CHOWN/SETUID/SETGID to
    # set up /config, and dropping them crash-loops it (the same failure we hit pinning user:1000).
    security_opt:
      - no-new-privileges:true
    environment:
      - TZ=Europe/Budapest
    volumes:
      - komga_config:/config
      - ${USERDATA_PATH}/media/comics:/data
    networks:
      - traefik-public
    deploy:
      resources:
        limits:
          memory: 512M
    # HC override: komga's actuator lives at /actuator/health (unauthenticated, 200), NOT under the
    # auth-gated /api/v1 API prefix — the old /api/v1/actuator/health returns 401 so `curl -f` failed
    # (exit 22) and the container reported "unhealthy" despite serving fine. The gotson/komga image
    # ships curl (verified), so curl -f on the unauthenticated endpoint is the correct probe.
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:25600/actuator/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.komga.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.komga.entrypoints=websecure"
      - "traefik.http.routers.komga.tls=true"
      - "traefik.http.routers.komga.tls.certresolver=letsencrypt"
      - "traefik.http.services.komga.loadbalancer.server.port=25600"

volumes:
  komga_config:

networks:
  traefik-public:
    external: true