# Warp all-in-one on PocketBase with SeaweedFS split into its roles: the
# homeserver, the admin panel, the web client, and SeaweedFS's master,
# volume, filer, S3 gateway and admin UI, all in one container pulled from
# a registry (the image is built from Dockerfile.PocketBase.SeaweedFS.split).
#
#   cd Docker-AIO
#   cp .env.pocketbase.seaweedfs.split.prod.example .env      # then edit it
#   docker compose -f docker-compose.pocketbase.seaweedfs.split.prod.yml up -d
#
# The database stays in /data/pb_data (warp-data); media goes to the bucket
# WARP_PB_S3_BUCKET in SeaweedFS (seaweed-data). The homeserver's S3 identity
# is seeded into the filer's IAM store on every boot, beside any added in
# the admin UI under Object Store → Users. Media stored before S3 was on is
# not moved into the bucket.
#
# Homeserver http://localhost:8008, admin panel http://localhost:8009, web
# client http://localhost:8080. The S3 gateway (8333) and the SeaweedFS admin
# UI (23646) are published on loopback; SEAWEED_S3_BIND and
# SEAWEED_ADMIN_BIND=0.0.0.0 expose them, the admin UI only behind a proxy.
#
# This and docker-compose.pocketbase.seaweedfs.yml share their project and
# volumes: SeaweedFS's data has the same layout either way, so switching
# between them needs no migration.
#
# Create the first administrator once the server is up:
#
#   docker compose -f docker-compose.pocketbase.seaweedfs.split.prod.yml exec warp warp create-account --username admin --admin
#
# Nothing is built here: the image comes from WARP_REGISTRY (default
# ghcr.io/dariuszjaniak) at tag WARP_VERSION (default latest). Pin
# WARP_VERSION to a release in production, and update with
#
#   docker compose -f docker-compose.pocketbase.seaweedfs.split.prod.yml pull && docker compose -f docker-compose.pocketbase.seaweedfs.split.prod.yml up -d

name: warp-aio-pocketbase-seaweedfs

services:
  warp:
    image: ${WARP_REGISTRY:-ghcr.io/dariuszjaniak}/warp-aio-pocketbase-seaweedfs-split:${WARP_VERSION:-latest}
    pull_policy: always
    restart: unless-stopped
    env_file: .env
    environment:
      # The gateway is in the container at a fixed address; these override
      # whatever .env says about S3.
      WARP_PB_S3_ENABLED: "true"
      WARP_PB_S3_ENDPOINT: http://127.0.0.1:8333
      WARP_PB_S3_BUCKET: ${WARP_PB_S3_BUCKET:-warp}
      WARP_PB_S3_REGION: us-east-1   # SeaweedFS ignores it; the client wants one
      WARP_PB_S3_FORCE_PATH_STYLE: "true"
      # The homeserver's identity in SeaweedFS, and what it signs with.
      WARP_PB_S3_ACCESS_KEY: ${WARP_PB_S3_ACCESS_KEY:?set WARP_PB_S3_ACCESS_KEY in .env}
      WARP_PB_S3_SECRET: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
      # The admin UI can mint bucket credentials, so it needs a password.
      WEED_ADMIN_USER: ${SEAWEED_ADMIN_USER:-admin}
      WEED_ADMIN_PASSWORD: ${SEAWEED_ADMIN_PASSWORD:?set SEAWEED_ADMIN_PASSWORD in .env}
      WEED_ADMIN_READONLY_USER: ${SEAWEED_ADMIN_READONLY_USER:-}
      WEED_ADMIN_READONLY_PASSWORD: ${SEAWEED_ADMIN_READONLY_PASSWORD:-}
    volumes:
      - warp-data:/data
      - seaweed-data:/seaweed/data
      - seaweed-admin:/seaweed/admin
    ports:
      - "${WARP_PORT:-8008}:8008"
      - "${WARP_ADMIN_PORT:-8009}:8009"
      - "${WARP_WEB_PORT:-8080}:8080"
      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
      - "${SEAWEED_ADMIN_BIND:-127.0.0.1}:${SEAWEED_ADMIN_PORT:-23646}:23646"

volumes:
  warp-data:
  # Master, volume and filer share it, as `weed server -dir` lays it out.
  seaweed-data:
  # The admin UI's session key and maintenance state; no object data.
  seaweed-admin: