services:
  maestro-engine:
    image: maestro
    container_name: maestro
    ports:
      # Loopback-only by default (owner gate ships session cookies). Reach it
      # via `ssh -L 8080:127.0.0.1:8080 <host>` or put a TLS reverse proxy in
      # front — see README "Access & transport".
      - "127.0.0.1:8080:8080"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
      - "${XDG_DATA_HOME:-${HOME}}/.dcntrlized:/data/.dcntrlized"
      - "${HOME}:/host-home:ro"
    networks:
      - dcntrlized_net
    build:
      context: .
      dockerfile: Dockerfile
    environment:
      - XDG_DATA_HOME=/data
      - GITEA_REGISTRY_RO_TOKEN=${GITEA_REGISTRY_RO_TOKEN}
      - GITEA_RW_PACKAGE_TOKEN=${GITEA_RW_PACKAGE_TOKEN}
      - GITEA_ORG=${GITEA_ORG:-Dcntrlized}
      - GITEA_USER=${GITEA_USER:-admin}
      - GIT_TOKEN=${GIT_TOKEN}
      - REGISTRY_USER=${REGISTRY_USER:-admin}

networks:
  dcntrlized_net:
    external: true