docker-compose.yml

networks:
  traefik:
    external: true

volumes:
  # Persists the SQLite DB across restarts/redeploys. The image ships /data owned
  # by nonroot (65532), so this fresh named volume inherits writable ownership.
  dday-data:
  # Persists the bot's DM room cache (handle -> room id) across restarts. Kept
  # separate from dday-data so the bot never touches the web service's DB. Same
  # ownership story: the image ships /data owned by nonroot (65532), so this
  # fresh named volume inherits writable ownership for uid 65532.
  bot-data:

services:
  dday:
    networks:
      - traefik
    labels:
        traefik.http.routers.dday.rule: "Host(`dday.hs-ldz.pl`)"
        traefik.http.routers.dday.entrypoints: "websecure"
        traefik.http.routers.dday.tls.certresolver: "myresolver"
    expose:
      - "3329"
    restart: unless-stopped
    build: .
    volumes:
      - dday-data:/data
    environment:
      # Private age key (decrypts registration tokens) passed BY VALUE as base64,
      # not as a mounted file — a 0600 key file is unreadable by the distroless
      # nonroot user (uid 65532), which crash-loops the container. `make up`
      # writes AGE_KEY_DATA into .env (gitignored) from config/dday_ed25519.
      # If unset, the landing still serves and only registration returns 503.
      AGE_KEY_DATA: ${AGE_KEY_DATA:-}
      # SQLite DB path on the persistent volume.
      DB_PATH: /data/dday.db
      # Registration time gate, sourced from .env (not hardcoded). `make up` writes
      # REGISTRATION_OPEN=1 there, forcing registration open NOW; set it to 0 or
      # delete the line to fall back to the built-in time gate (opens 2026-07-26
      # 15:00 Europe/Warsaw). Empty here means "unset" → time gate.
      REGISTRATION_OPEN: ${REGISTRATION_OPEN:-}
      # Shared secret guarding GET /api/registered (the bot's "already registered?"
      # probe). `make up` writes a stable INTERNAL_TOKEN into .env so both services
      # agree. If empty, the endpoint is disabled (404) and the bot skips the check.
      INTERNAL_TOKEN: ${INTERNAL_TOKEN:-}
      # Shared HMAC key authenticating the registration link token. `make up` writes
      # a stable TOKEN_SECRET into .env so the bot (which signs) and web (which
      # verifies) agree. If empty, links carry no real authenticity — production
      # always has one generated.
      TOKEN_SECRET: ${TOKEN_SECRET:-}

  # The Matrix bot: a separate long-lived process that listens for !register and
  # DMs the sender a registration link (or a "not open yet" notice when closed).
  # It reuses the same image but overrides the entrypoint to run /bot.
  bot:
    # No `networks:` — the bot must reach matrix.org, so it stays on the default
    # project network (egress NAT). The `traefik` external network is inbound-only
    # for the web service and would not give the bot internet access.
    build: .
    entrypoint: ["/bot"]
    restart: unless-stopped
    # matrix.env (gitignored) supplies MATRIX_HOMESERVER/USER/PASSWORD + REGISTER_URL.
    env_file: matrix.env
    volumes:
      - bot-data:/data
    environment:
      # Persist the DM room cache on the volume so it survives restarts: after a
      # redeploy the bot reuses the recorded DM for a known handle without asking
      # the server. /data is owned by nonroot (65532) in the image.
      DM_CACHE_PATH: /data/dm_cache.json
      # matrix.env also sets AGE_PUB=config/... — a host path that does not exist
      # inside the image. Override with the public key passed BY VALUE as base64;
      # the bot prefers AGE_PUB_DATA over AGE_PUB. `make up` writes it into .env.
      AGE_PUB_DATA: ${AGE_PUB_DATA:-}
      # Same time gate as the web service, sourced from .env. `make up` writes
      # REGISTRATION_OPEN=1 (open now); set 0 or delete the .env line to fall back
      # to the built-in time gate (opens 2026-07-26 15:00 Europe/Warsaw).
      REGISTRATION_OPEN: ${REGISTRATION_OPEN:-}
      # Same shared secret as the web service, so the bot can call
      # GET /api/registered before issuing a link. Empty → the bot skips the check.
      INTERNAL_TOKEN: ${INTERNAL_TOKEN:-}
      # Shared HMAC key authenticating the registration link token — must match the
      # web service so the token the bot signs verifies there. `make up` writes it.
      TOKEN_SECRET: ${TOKEN_SECRET:-}