# Self-contained compose project for ttrpg.briggen.dev.
# Deploy: rsync the repo to /root/briggen-dev/ttrpg/, place this file there as
# docker-compose.yml, then `docker compose up -d --build`.
# Joins the EXISTING external `proxy` network — the shared Traefik stack is untouched.
name: ttrpg

services:
  ttrpg:
    build: .
    container_name: ttrpg
    restart: unless-stopped
    environment:
      - PORT=8787
      - STATIC_DIR=/app/dist
      - NODE_ENV=production
      - DATA_DIR=/data
      - ALLOWED_ORIGINS=https://ttrpg.briggen.dev
      # comma-separated usernames that can see the admin panel (set to your account)
      - ADMIN_USERS=nilsb
      # default per-user cloud storage cap (bytes); admins override per user in the dashboard
      - DEFAULT_QUOTA_BYTES=31457280   # 30 MB
      # hard ceiling on accounts so open registration can't fill the disk
      - MAX_USERS=500
    volumes:
      - ttrpg-data:/data
    security_opt:
      - no-new-privileges:true
    # Hard caps so a runaway session can't starve the host or the shared Traefik
    # stack — the blast radius stays this container, then `restart: unless-stopped`.
    mem_limit: 512m
    memswap_limit: 512m
    pids_limit: 200
    cpus: 1.0
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.ttrpg.rule=Host(`ttrpg.briggen.dev`)"
      - "traefik.http.routers.ttrpg.entrypoints=websecure"
      - "traefik.http.routers.ttrpg.tls.certresolver=letsencrypt"
      - "traefik.http.services.ttrpg.loadbalancer.server.port=8787"
    networks:
      - proxy

volumes:
  ttrpg-data:

networks:
  proxy:
    external: true