# Gokapi - Ideiglenes fájlmegosztás lejáró linkekkel
# Domain: ${SUBDOMAIN}.${DOMAIN}
# Database: SQLite (file-based)
# RAM: ~30M (mem_limit: 128M) | Pi-compatible: Yes
#
# Headless setup (Gokapi v1.9.6 has NO env-var setup): Gokapi otherwise serves a public "maintenance
# mode" page with an OPEN /setup wizard until someone completes it (unauthenticated admin-takeover risk).
# The entrypoint below seeds a config.json on first boot (admin user, this app's public URL, local
# storage, no encryption so it restarts without a prompt) with the password/salts cleared, then runs the
# documented `--deployment-password` one-shot to set the felhom-generated admin password BEFORE the
# server starts serving — so the admin account is claimed at first boot and /setup is never exposed.
# The seed config is pinned to Gokapi v1.9.6 (ConfigVersion 21); re-capture it if the image is bumped.

services:
  gokapi:
    image: f0rc3/gokapi:v1.9.6
    container_name: gokapi
    restart: unless-stopped
    environment:
      - TZ=Europe/Budapest
      - GOKAPI_PASSWORD=${GOKAPI_PASSWORD}
    entrypoint:
      - /bin/sh
      - -c
      - |
        if [ ! -f /app/config/config.json ]; then
          echo "[felhom] first boot — seeding Gokapi config and claiming admin account"
          printf '%s' '{"Authentication":{"Method":0,"SaltAdmin":"","SaltFiles":"","Username":"admin","Password":"","HeaderKey":"","OauthProvider":"","OAuthClientId":"","OAuthClientSecret":"","OauthUserScope":"","OauthGroupScope":"","OAuthRecheckInterval":12,"HeaderUsers":null,"OAuthGroups":[],"OauthUsers":[]},"Port":":53842","ServerUrl":"https://${SUBDOMAIN}.${DOMAIN}/","RedirectUrl":"https://${SUBDOMAIN}.${DOMAIN}/admin","PublicName":"Gokapi","DataDir":"data","DatabaseUrl":"sqlite://./data/gokapi.sqlite","ConfigVersion":21,"LengthId":15,"MaxFileSizeMB":102400,"MaxMemory":50,"ChunkSize":45,"MaxParallelUploads":4,"Encryption":{"Level":0,"Cipher":null,"Salt":"","Checksum":"","ChecksumSalt":""},"UseSsl":false,"PicturesAlwaysLocal":false,"SaveIp":false,"IncludeFilename":false}' > /app/config/config.json
          /app/run.sh --deployment-password "$${GOKAPI_PASSWORD}"
        fi
        exec /app/run.sh
    volumes:
      - gokapi_data:/app/data
      - gokapi_config:/app/config
    networks:
      - traefik-public
    deploy:
      resources:
        limits:
          memory: 128M
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:53842"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.gokapi.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.gokapi.entrypoints=websecure"
      - "traefik.http.routers.gokapi.tls=true"
      - "traefik.http.routers.gokapi.tls.certresolver=letsencrypt"
      - "traefik.http.services.gokapi.loadbalancer.server.port=53842"

volumes:
  gokapi_config:
  gokapi_data:

networks:
  traefik-public:
    external: true