# Cal.com — VPS (ROOTLESS PODMAN). Ported from the home server 2026-08-12.
#
# ⚠️ NOT STARTED. No systemd unit is enabled. It has never run on either machine, so
# there is no data to migrate. Bring it up with:
#     systemctl --user enable --now podman-calcom.service
#
# BEFORE FIRST START, create its role and database on the SHARED postgres (this stack
# no longer ships its own):
#     podman exec -i postgresql psql -U npm <<'SQL'
#     CREATE ROLE calcom LOGIN PASSWORD '<see this service .env on the machine>';
#     CREATE DATABASE calcom OWNER calcom;
#     SQL
# Then add the same lines to PostgreSQL/initdb/00-roles-and-databases.sql.
#
# Also unset: EMAIL_SERVER_HOST/USER/PASSWORD are still CHANGE_ME. Cal.com will run,
# but booking confirmations and invitations will not send.
#
# Note Cal.com runs database migrations on first boot and can take several minutes to
# become responsive. The unit allows 900s for this.
#
# Rootless adaptations from the home version:
#   - Dropped its private postgres:16-alpine; uses the shared instance (AGENTS.md §2).
#   - /etc/localtime mount removed in favour of TZ (AGENTS.md §8).
#   - No bind mounts remain, so no :Z is needed.
#
# NPM: proxy cal.gbrown.org -> http://calcom:3000

networks:
  nginx-bridge:
    external: true

services:
  calcom:
    image: docker.io/calcom/cal.com:latest
    container_name: calcom
    hostname: calcom
    domainname: cal.gbrown.org
    networks: ['nginx-bridge']
    environment:
      - TZ=America/New_York
      - NEXT_PUBLIC_WEBAPP_URL=https://cal.gbrown.org
      - NEXT_PUBLIC_WEBSITE_URL=https://cal.gbrown.org
      - NEXTAUTH_URL=https://cal.gbrown.org/api/auth
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
      - CALENDSO_ENCRYPTION_KEY=${CALENDSO_ENCRYPTION_KEY}
      # Shared postgres, not a private container
      - DATABASE_URL=${DATABASE_URL}
      - DATABASE_DIRECT_URL=${DATABASE_DIRECT_URL}
      - NEXT_PUBLIC_LICENSE_CONSENT=agree
      - ALLOWED_HOSTNAMES="cal.gbrown.org"
      - EMAIL_FROM=cal@gbrown.org
      - EMAIL_SERVER_HOST=CHANGE_ME
      - EMAIL_SERVER_PORT=587
      - EMAIL_SERVER_USER=CHANGE_ME
      - EMAIL_SERVER_PASSWORD=${EMAIL_SERVER_PASSWORD}
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    tty: true
    stdin_open: true
    restart: unless-stopped