# Runs Flow on your own server. Put this file in a folder of its own, then:
#
#   docker compose up -d                         start Flow (the first time, it downloads it)
#   docker compose pull && docker compose up -d  update to the newest version
#
# Settings go in a .env file next to this one, all optional; .env.example lists them.
# Flow listens only on this machine, on port 3000 (or FLOW_PORT from .env if 3000 is taken). Serve it over HTTPS:
#   - over Tailscale, privately:  tailscale serve --bg 3000   →   https://<this-machine>.<your-tailnet>.ts.net
#   - on your own domain, behind a reverse proxy you run (Nginx Proxy Manager, Traefik, Caddy, nginx) that
#     forwards https://flow.example.com to Flow. docs/self-hosting.md shows how.
#
# With Flow's source code next to it, docker compose up -d --build builds the image from it instead.
services:
  flow:
    image: ghcr.io/massimobrivio/flow:${FLOW_VERSION:-latest}
    build: .
    restart: unless-stopped
    ports:
      - "127.0.0.1:${FLOW_PORT:-3000}:80"
    environment:
      # Optional. Without it, Flow makes its own key on first start and keeps it in the flow-storage volume.
      SECRET_KEY_BASE: ${SECRET_KEY_BASE:-}
      # true: something in front of Flow (Tailscale, a reverse proxy) serves it over HTTPS.
      FLOW_SSL: ${FLOW_SSL:-true}
      # The address your devices use, e.g. https://myserver.<tailnet>.ts.net. Links in emails and from
      # bin/rails users:reset_password start with it. Needed once email is on.
      FLOW_URL: ${FLOW_URL:-}
      # Email, optional. Flow sends email only when SMTP_ADDRESS is set.
      SMTP_ADDRESS: ${SMTP_ADDRESS:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_AUTHENTICATION: ${SMTP_AUTHENTICATION:-plain}
      SMTP_ENABLE_STARTTLS: ${SMTP_ENABLE_STARTTLS:-true}
      MAIL_FROM: ${MAIL_FROM:-}
      # closed: after the first account, only bin/rails users:create makes accounts. open: anyone can sign up.
      FLOW_SIGNUPS: ${FLOW_SIGNUPS:-closed}
      # true: signed-out visitors see a page about Flow instead of the sign-in page. For a hosted Flow.
      FLOW_LANDING: ${FLOW_LANDING:-false}
      # true: new accounts confirm their email before they can use Flow.
      FLOW_REQUIRE_CONFIRMATION: ${FLOW_REQUIRE_CONFIRMATION:-false}
    volumes:
      # The SQLite database (and the key Flow made) live here and survive updates and restarts.
      - flow-storage:/rails/storage
    healthcheck:
      test: ["CMD", "curl", "-fs", "-o", "/dev/null", "http://localhost/up"]
      interval: 30s
      timeout: 5s
      start_period: 30s
      retries: 3

volumes:
  flow-storage: