services:
  termix:
    image: ghcr.io/termix-ssh/termix:latest
    container_name: termix
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - termix-data:/app/data
    environment:
      PORT: "8080"
      # Multi-instance deployments should point every backend at the same
      # Redis. Without it, collaboration rooms keep their single-instance
      # in-memory fallback.
      # REDIS_URL: "redis://redis:6379"
      # TERMIX_REDIS_PREFIX: "termix:collab"
      # TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
      # Hardened deployments can require keys from environment variables or
      # Docker secrets mounted through JWT_SECRET_FILE, DATABASE_KEY_FILE,
      # ENCRYPTION_KEY_FILE and INTERNAL_AUTH_TOKEN_FILE.
      # TERMIX_REQUIRE_EXTERNAL_SECRETS: "true"
      # Trusted reverse-proxy authentication is disabled by default. When
      # enabled, do not expose this container directly to untrusted clients.
      # TRUSTED_PROXY_AUTH_ENABLED: "true"
      # List the address your authenticating proxy connects from, as this
      # container sees it (for a proxy container on termix-net, its IP there).
      # Keep it narrow: published ports can reach the container from the
      # Docker gateway, so do not trust whole private ranges.
      # TRUSTED_PROXY_AUTH_TRUSTED_PROXIES: "172.20.0.10"
      # TRUSTED_PROXY_AUTH_ROLE_MAP: '{"operators":["user"]}'
      # TRUSTED_PROXY_AUTH_USERNAME_HEADER: "x-forwarded-username"
      # TRUSTED_PROXY_AUTH_ROLE_HEADER: "x-forwarded-role"
    networks:
      - termix-net

volumes:
  termix-data:
    driver: local

networks:
  termix-net:
    driver: bridge