# Vikunja - Feladatkezelő listák és táblák (Todoist/Trello alternatíva)
# Domain: ${SUBDOMAIN}.${DOMAIN}
# Database: None (file-based)
# RAM: ~50M (mem_limit: 256M) | Pi-compatible: Yes
#
# Environment variables:
#   DOMAIN          - Your domain (e.g., demo-felhom.eu)
#   VIKUNJA_SERVICE_JWTSECRET- JWT titkosítási kulcs (auto-generated)

services:
  vikunja:
    image: vikunja/vikunja:2.6.0
    container_name: vikunja
    user: "0:0"
    restart: unless-stopped
    environment:
      # decision 47: the app's own sign-up switch — open until the box closes it after the first admin (after_setup)
      - VIKUNJA_SERVICE_ENABLEREGISTRATION=${SIGNUP_OPEN:-true}
      - TZ=Europe/Budapest
      - VIKUNJA_SERVICE_PUBLICURL=https://${SUBDOMAIN}.${DOMAIN}
      - VIKUNJA_SERVICE_JWTSECRET=${VIKUNJA_SERVICE_JWTSECRET}
      # R-776 (R-753, controller >= 0.286.0): the default `direct` reads the TCP peer (traefik) — one address for every
      # visitor, so a stranger trips the login floor (10/min per address) for the household. `xff` walks X-Forwarded-For
      # from the RIGHT skipping private addresses (echo's default trust): the tunnel's real visitor, or the LAN client.
      # measured on 9202 2026-10-06 with a control (checklist 3.6; felhom.eu audits/morning-after-2026-10-06/live-9202/).
      - VIKUNJA_SERVICE_IPEXTRACTIONMETHOD=xff
    volumes:
      - vikunja_data:/app/vikunja/files
      - vikunja_db:/db
    networks:
      - traefik-public
    deploy:
      resources:
        limits:
          memory: 256M
    # No healthcheck (R-760): the image ships no shell (scripts/upgrade-test.py reads its OOM counter host-side
    # for that reason), so neither the CMD-SHELL nor the wget/curl family of REUSE.md §2 can run inside it. Not
    # measured: whether the image declares its own HEALTHCHECK. The box is not blind — its own probe
    # (.felhom.yml `healthcheck.checks`, api :3456 /api/v1/info expect 200) dials it from outside; only
    # Docker's own health state is empty. A healthcheck here needs the image's config READ first, never guessed.
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vikunja.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.vikunja.entrypoints=websecure"
      - "traefik.http.routers.vikunja.tls=true"
      - "traefik.http.routers.vikunja.tls.certresolver=letsencrypt"
      - "traefik.http.services.vikunja.loadbalancer.server.port=3456"

volumes:
  vikunja_data:
  vikunja_db:

networks:
  traefik-public:
    external: true