# Example docker-compose deployment for Palette.
# All environment variables are optional; sensible defaults apply.
# The only hard requirement is a volume on /data so the SQLite database
# and the auto-generated admin key survive restarts.

services:
  palette:
    image: git.archfox.org/poslop/palette:v0.2.2
    # image: git.archfox.org/poslop/palette:latest   # tracks main, less stable
    restart: unless-stopped
    ports:
      - "8080:8080"          # host:container; the app listens on :8080
    volumes:
      - palette-data:/data   # REQUIRED: SQLite db, admin key, attachments
    environment:
      # Address the server binds to inside the container.
      # Default: ":8080". Only change if you also change the ports mapping.
      PALETTE_ADDR: ":8080"

      # Path to the SQLite database file.
      # Default: "/data/palette.db". Keep it on the /data volume.
      PALETTE_DB: "/data/palette.db"

      # Admin API key for /admin/api/settings (rate limits, size caps, expiry).
      # Default: random key generated on first start and persisted to
      # /data/admin-key (mode 0600). Read it with:
      #   docker compose exec palette cat /data/admin-key
      # Set this only if you want a fixed key (e.g. for automation).
      # PALETTE_ADMIN_KEY: "change-me"

      # Max size in bytes of a single text paste. Oversized creates get 413.
      # Default: 5242880 (5 MiB).
      # PALETTE_MAX_TEXT: "5242880"

      # Max size in bytes of a single can item (file/text inside a can) or a
      # paste file attachment.
      # Default: 26214400 (25 MiB).
      # PALETTE_MAX_ITEM: "26214400"

      # Default dark mode for new visitors. Unset = dark on; set to "false",
      # "0" or "off" to default to light mode. Visitors who toggle dark mode
      # keep their choice in their browser.
      # PALETTE_DEFAULT_DARK: "false"

      # HMAC secret for password-unlock cookies. Default: random per start,
      # which logs out every unlocked browser session on restart. Set a fixed
      # secret (any random string) to keep unlock sessions across restarts,
      # or when running multiple replicas that must agree.
      # PALETTE_UNLOCK_SECRET: "generate-with-openssl-rand-base64-32"

volumes:
  palette-data: