# Vellum — one container, alongside the existing stack.
#
# Volume layout:
#   /data     the SQLite database (vellum.db) and persistent state — read/write
#   /config   regenerable cache: covers, thumbnails, extracted pages — read/write
#   /media/*  the media library, one bind mount per kind, ALL read-only.
#
# Vellum never writes to /media. It only ever reads. If a media mount is not
# read-only, that is a bug in this file, not a feature.
#
# Mount flags match the conventions used elsewhere in this stack:
#   :z        SELinux relabel (mandatory on this host, getenforce = Enforcing)
#   :ro       the media library is read-only; Vellum never writes to it
#
# Paths here are the TARGET HOST's (/opt/mediaserver, /mnt/storage). They do
# not exist on the dev workstation — build locally with the Dockerfile instead.

services:
  vellum:
    build:
      context: .
      args:
        VERSION: 0.1.0-dev
    image: localhost/vellum:0.1.0-dev
    container_name: vellum
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
    environment:
      - PUID=1001
      - PGID=1001
      - TZ=America/New_York
      - VELLUM_LISTEN=:7788
      - VELLUM_LOG_LEVEL=info
      # Read-only library roots, colon-separated. Each entry must correspond to
      # one of the read-only mounts below.
      - VELLUM_MEDIA_DIRS=/media/ebooks:/media/comics:/media/audiobooks:/media/music:/media/photos:/media/games
      # Metadata providers (optional; leave blank to disable).
      - VELLUM_IGDB_CLIENT_ID=
      - VELLUM_IGDB_CLIENT_SECRET=
      - VELLUM_COMICVINE_API_KEY=
      # Set to true when serving over TLS behind a reverse proxy.
      - VELLUM_COOKIE_SECURE=false
    volumes:
      - /opt/mediaserver/vellum/data:/data:z
      - /opt/mediaserver/vellum/config:/config:z
      # Media: one read-only mount per kind. The container never writes here.
      - /mnt/storage/media/ebooks:/media/ebooks:ro,z
      - /mnt/storage/media/comics:/media/comics:ro,z
      - /mnt/storage/media/audiobooks:/media/audiobooks:ro,z
      - /mnt/storage/media/music:/media/music:ro,z
      - /mnt/storage/media/photos:/media/photos:ro,z
      - /mnt/storage/media/games:/media/games:ro,z
    ports:
      - 127.0.0.1:7788:7788
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"