docker-compose.yml

version: '1.0'

# Use this version for Unraid with bind mount to appdata
# Before starting, create the data directory:
#   mkdir -p /mnt/user/appdata/site-manager/data

services:
  site-manager:
    build: .
    container_name: site-manager
    ports:
      - "3010:3010"   # Admin interface (keep internal/protected)
      - "3011:3011"   # Public read-only (expose via CF tunnel)
      # To change the host port, only change the LEFT side (e.g. "8080:3011")
      # Do NOT change PUBLIC_PORT below - it must match the right side of the port mapping

    volumes:
      # Bind mount - change path to your Unraid appdata location
      - /mnt/user/appdata/site-manager/data:/app/data
      - /mnt/user/appdata/site-manager/uploads:/app/uploads
      
    environment:
      - NODE_ENV=production
      - PORT=3010
      - PUBLIC_PORT=3011
      - DB_PATH=/app/data/site.db

      # Hybrid auth (Cloudflare Access + local fallback)
      - ADMIN_TRUST_CLOUDFLARE_ACCESS=true
      - ADMIN_ALLOWED_EMAILS=you@example.com
      - SESSION_SECRET=change-this-to-a-long-random-string
      - ADMIN_PASSWORD_HASH=$2a$10$REPLACE_WITH_BCRYPT_HASH
      
      # Uploads
      - UPLOAD_MAX_MB=15
      - COOKIE_SECURE=true
      
    networks:
      - guac-net
    # Run as specific user/group if needed (uncomment and adjust)
    # user: "99:100"  # nobody:users on Unraid
    restart: unless-stopped

networks:
  guac-net:
    external: true