# Tools — small self-hosted utilities. VPS (ROOTLESS PODMAN) port of the home server's
# ~/Server/tools stack, migrated 2026-08-12.
#
# Rootless adaptations:
#   - :Z on every bind mount (SELinux Enforcing). All mounts here are exclusive to a
#     single container, so uppercase :Z is correct -- see AGENTS.md §6.
#   - No ports published: NPM proxies to each container by name over nginx-bridge.
#
# All four images start as root and drop privileges internally, so no userns_mode is
# needed (AGENTS.md §3.2).

networks:
  nginx-bridge:
    external: true

services:
  convertx:
    image: ghcr.io/c4illin/convertx:latest
    container_name: convertx
    hostname: convertx
    domainname: convert.tools.gbrown.org
    networks: ['nginx-bridge']
    environment:
      - TZ=America/New_York
      - ALLOW_UNAUTHENTICATED=true
      - ACCOUNT_REGISTRATION=false
      - HIDE_HISTORY=true
    volumes:
      - ./volumes/convertx:/app/data:Z
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    tty: true
    restart: unless-stopped

  it-tools:
    image: docker.io/corentinth/it-tools:latest
    container_name: it-tools
    hostname: it-tools
    domainname: tools.gbrown.org
    networks: ['nginx-bridge']
    environment:
      - TZ=America/New_York
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    tty: true
    restart: unless-stopped

  pdf-tools:
    image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest
    container_name: pdf-tools
    hostname: pdf-tools
    domainname: pdf.tools.gbrown.org
    networks: ['nginx-bridge']
    environment:
      - TZ=America/New_York
      - LANGS=en_US
      - DOCKER_ENABLE_SECURITY=true
    volumes:
      - ./volumes/pdf-tools/trainingData:/usr/share/tessdata:Z
      - ./volumes/pdf-tools/extraConfigs:/configs:Z
      - ./volumes/pdf-tools/customFiles:/customFiles:Z
      - ./volumes/pdf-tools/logs:/logs/:Z
      - ./volumes/pdf-tools/pipeline:/pipeline/:Z
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    tty: true
    restart: unless-stopped

  bento-pdf:
    image: ghcr.io/alam00000/bentopdf:latest
    container_name: bento-pdf
    hostname: bento-pdf
    domainname: bento.tools.gbrown.org
    networks: ['nginx-bridge']
    environment:
      - TZ=America/New_York
      - PUID=1000
      - PGID=1000
      - VITE_BRAND_NAME="GibPDF"
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    tty: true
    restart: unless-stopped
    healthcheck:
      test: ['CMD', 'wget', '--spider', '-q', 'http://localhost:8080']
      interval: 30s
      timeout: 10s
      retries: 3