# Documenso — VPS (ROOTLESS PODMAN). Ported from the home server 2026-08-12.
#
# ⚠️ NOT STARTED. No systemd unit is enabled for this. It has never run on either
# machine, so there is no data to migrate. Bring it up with:
#     systemctl --user enable --now podman-documenso.service
#
# BEFORE FIRST START, two things must happen:
#
#   1. Create its role and database on the SHARED postgres (this stack no longer
#      ships its own):
#        podman exec -i postgresql psql -U npm <<'SQL'
#        CREATE ROLE documenso LOGIN PASSWORD '<see this service .env on the machine>';
#        CREATE DATABASE documenso OWNER documenso;
#        SQL
#      Then add the same lines to PostgreSQL/initdb/00-roles-and-databases.sql so a
#      rebuild recreates them.
#
#   2. Provide a signing certificate at ./volumes/cert/cert.p12, or Documenso will
#      not start. Generate one with:
#        openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 3650 -nodes
#        openssl pkcs12 -export -out cert.p12 -inkey key.pem -in cert.pem -passout pass:
#
# Also unset: the four NEXT_PRIVATE_SMTP_* values are still CHANGE_ME. Documenso will
# run without working email, but signature invitations will fail to send.
#
# Rootless adaptations from the home version:
#   - Dropped its private postgres:16-alpine; uses the shared instance (AGENTS.md §2).
#   - :Z on bind mounts (SELinux Enforcing).
#   - /etc/localtime mounts removed in favour of TZ (AGENTS.md §8).
#
# NPM: proxy docs.gbrown.org -> http://documenso:3000

networks:
  nginx-bridge:
    external: true

services:
  documenso:
    image: docker.io/documenso/documenso:latest
    container_name: documenso
    hostname: documenso
    domainname: docs.gbrown.org
    networks: ['nginx-bridge']
    environment:
      - TZ=America/New_York
      - PORT=3000
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
      - NEXT_PRIVATE_ENCRYPTION_KEY=${NEXT_PRIVATE_ENCRYPTION_KEY}
      - NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY=${NEXT_PRIVATE_ENCRYPTION_SECONDARY_KEY}
      - NEXT_PUBLIC_WEBAPP_URL=https://docs.gbrown.org
      - NEXTAUTH_URL=https://docs.gbrown.org
      # Shared postgres, not a private container
      - NEXT_PRIVATE_DATABASE_URL=${NEXT_PRIVATE_DATABASE_URL}
      - NEXT_PRIVATE_DIRECT_DATABASE_URL=${NEXT_PRIVATE_DIRECT_DATABASE_URL}
      - NEXT_PRIVATE_SIGNING_TRANSPORT=local
      - NEXT_PRIVATE_SIGNING_LOCAL_FILE_PATH=/opt/documenso/cert.p12
      - NEXT_PRIVATE_SIGNING_PASSPHRASE=
      - NEXT_PUBLIC_UPLOAD_TRANSPORT=database
      - NEXT_PRIVATE_SMTP_TRANSPORT=smtp-auth
      - NEXT_PRIVATE_SMTP_HOST=CHANGE_ME
      - NEXT_PRIVATE_SMTP_PORT=587
      - NEXT_PRIVATE_SMTP_USERNAME=CHANGE_ME
      - NEXT_PRIVATE_SMTP_PASSWORD=${NEXT_PRIVATE_SMTP_PASSWORD}
      - NEXT_PRIVATE_SMTP_FROM_NAME=Documenso
      - NEXT_PRIVATE_SMTP_FROM_ADDRESS=documenso@gbrown.org
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    volumes:
      - ./volumes/cert/cert.p12:/opt/documenso/cert.p12:Z
    tty: true
    stdin_open: true
    restart: unless-stopped