services:
  app:
    image: git.shx.one/denozord/cfdm:latest
    ports:
      - "8080:8080"
    environment:
      DATABASE_URL: sqlite:/data/app.db
      CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:-}
      JWT_SECRET: ${JWT_SECRET:-change-me-in-production}
      AUTH_REQUIRED: ${AUTH_REQUIRED:-false}
      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET:-${JWT_SECRET:-change-me-in-production}}
      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.shnt.top}
      AUTH_PORTAL_URL: ${AUTH_PORTAL_URL:-https://auth.shnt.top}
      ADMIN_USERNAME: ${ADMIN_USERNAME:-admin}
      ADMIN_PASSWORD_HASH: ${ADMIN_PASSWORD_HASH:-}
      LOG_LEVEL: info
      CERT_CHECK_CRON: "0 */6 * * *"
      STATIC_DIR: /app/static
    volumes:
      - ./data:/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s