# Adminer — database admin UI. VPS (ROOTLESS PODMAN), added 2026-08-12.
#
# On the home server this shipped alongside a MySQL container in the same compose
# file. Here it is standalone and defaults to the shared PostgreSQL instance, which
# is where the 14 databases now live (authentik, infisical_db, n8n, npm, the payload_*
# and convex databases, usesend, lashaddict-payload, spoon_convex...).
#
# MySQL stays on the home server — nothing on the VPS uses it.
#
# It can still reach any other database reachable on nginx-bridge; ADMINER_DEFAULT_SERVER
# only pre-fills the server field on the login form.
#
# ⚠️ SECURITY: Adminer has NO authentication of its own — it is a login form that
# forwards credentials to whichever database you name. Publishing it means exposing a
# database login prompt to the internet. Put it behind authentik forward-auth in NPM
# (same pattern as sonarr/prowlarr on the home server), or restrict it to the LAN by
# giving it only a UniFi record and no Cloudflare record.
#
# Rootless adaptations: no bind mounts (stateless, so no :Z needed), no published
# ports — NPM proxies to http://adminer:8080 over nginx-bridge.
#
# NPM: adminer.gbrown.org -> http://adminer:8080

networks:
  nginx-bridge:
    external: true

services:
  adminer:
    image: docker.io/library/adminer:latest
    container_name: adminer
    hostname: adminer
    domainname: adminer.gbrown.org
    networks:
      - nginx-bridge
    environment:
      - TZ=America/New_York
      # Pre-fills the server field; any nginx-bridge host can still be typed in.
      - ADMINER_DEFAULT_SERVER=postgresql
      - ADMINER_DESIGN=dracula
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    tty: true
    restart: unless-stopped