services:
  ihasmail:
    build:
      context: .
      args:
        # Passed to the build as well as the run because the web bundle writes
        # its own asset URLs: a build that does not know the prefix produces an
        # app that cannot load itself under one. Empty is the domain root.
        BASE_PATH: ${BASE_PATH:-}
    image: ihasmail:2
    restart: unless-stopped
    # Loopback only: ihasmail expects a TLS reverse proxy in front of it. On
    # every interface the app is reachable over plain HTTP, passwords and all,
    # and with TRUST_PROXY any machine on a private network can set its own
    # X-Forwarded-For. A proxy running in Docker can reach the service by name
    # on the compose network and needs no published port at all.
    ports:
      - "127.0.0.1:8080:8080"
    # The app needs no privileges and writes only to /data and /tmp.
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    environment:
      MAIL_SERVER_URL: ${MAIL_SERVER_URL:?set MAIL_SERVER_URL in .env}
      APP_SECRET: ${APP_SECRET:?set APP_SECRET in .env (openssl rand -base64 48)}
      APP_NAME: ${APP_NAME:-ihasmail}
      BASE_PATH: ${BASE_PATH:-}
      SOURCE_URL: ${SOURCE_URL:-https://git.coffeylabs.org/inbuxa/ihasmail-inbuxa}
      TRUST_PROXY: "1"
      IMAGE_PROXY: "1"
    volumes:
      - ihasmail-data:/data
volumes:
  ihasmail-data: