services:
  SnapOtter:
    image: snapotter/snapotter:latest  # or ghcr.io/snapotter-hq/snapotter:latest
    volumes:
      - /mnt/appdata/snapotter/data:/data
    networks:
      - proxy-net
    environment:
      # Server
      - PORT=${PORT:-1349}
      - AUTH_ENABLED=${AUTH_ENABLED:-false}
      #DEFAULT_USERNAME=admin
      #DEFAULT_PASSWORD=admin
      - STORAGE_MODE=${STORAGE_MODE:-local}
      - TRUST_PROXY=${TRUST_PROXY:-true}

      # Cleanup
      - FILE_MAX_AGE_HOURS=${FILE_MAX_AGE_HOURS:-72}
      - CLEANUP_INTERVAL_MINUTES=${CLEANUP_INTERVAL_MINUTES:-60}

      # Upload & Batch (0 = unlimited)
      - MAX_UPLOAD_SIZE_MB=${MAX_UPLOAD_SIZE_MB:-0}
      - MAX_BATCH_SIZE=${MAX_BATCH_SIZE:-0}
      - CONCURRENT_JOBS=${CONCURRENT_JOBS:-10}
      - MAX_MEGAPIXELS=${MAX_MEGAPIXELS:-0}

      # Rate limiting (0 = disabled)
      - RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-0}

      # Users (0 = unlimited)
      - MAX_USERS=${MAX_USERS:-0}

      # Processing (0 = auto/unlimited)
      - MAX_WORKER_THREADS=${MAX_WORKER_THREADS:-0}
      - PROCESSING_TIMEOUT_S=${PROCESSING_TIMEOUT_S:-0}
      - MAX_PIPELINE_STEPS=${MAX_PIPELINE_STEPS:-0}
      - MAX_CANVAS_PIXELS=${MAX_CANVAS_PIXELS:-0}
      - MAX_SVG_SIZE_MB=${MAX_SVG_SIZE_MB:-0}
      - MAX_LOGO_SIZE_KB=${MAX_LOGO_SIZE_KB:-2048}
      - MAX_SPLIT_GRID=${MAX_SPLIT_GRID:-100}
      - MAX_PDF_PAGES=${MAX_PDF_PAGES:-0}
      - SESSION_DURATION_HOURS=${SESSION_DURATION_HOURS:-168}
      - LOGIN_ATTEMPT_LIMIT=${LOGIN_ATTEMPT_LIMIT:-10}

      # Set to true in CI/dev to skip the forced password-change on the default admin
      # SKIP_MUST_CHANGE_PASSWORD=false
      - SKIP_MUST_CHANGE_PASSWORD=${SKIP_MUST_CHANGE_PASSWORD:-false}
      - DB_PATH=${DB_PATH:-./data/snapotter.db}
      - WORKSPACE_PATH=${WORKSPACE_PATH:-./tmp/workspace}
      - FILES_STORAGE_PATH=${FILES_STORAGE_PATH:-./data/files}
      - DEFAULT_THEME=${DEFAULT_THEME}
      - DEFAULT_LOCALE=${DEFAULT_LOCALE:-en}
      - APP_NAME=${APP_NAME:-snapotter}
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.snapotter.entrypoints=websecure"
      - "traefik.http.routers.snapotter.rule=Host(`snapotter.castaldifamily.com`)"
      - "traefik.http.routers.snapotter.tls=true"
      - "traefik.http.routers.snapotter.tls.certresolver=cloudflare"
      - "traefik.http.routers.snapotter.service=snapotter"
      - "traefik.http.services.snapotter.loadbalancer.server.port=1349"
      - "traefik.http.routers.snapotter.middlewares=authentik-auth@file"

networks:
  proxy-net:
    external: true