# Infisical — VPS (ROOTLESS PODMAN) port of the home server's ~/Server/infisical,
# migrated 2026-08-12.
#
# CONSOLIDATED ONTO THE SHARED POSTGRES. Home runs a dedicated postgres:14 for infisical;
# here it uses the shared `postgresql` container (PG 17) alongside authentik, n8n and NPM.
# The PG14 dump restored into PG17 cleanly (no extensions, 749 tables, row counts verified
# identical). One postgres to back up, patch and monitor instead of several.
#
#   role/database:  infisical_user / infisical_db   (created in the shared instance)
#   DB_CONNECTION_URI in .env points at host `postgresql`, not the old `db`
#   REDIS_URL points at `infisical-redis` -- container_name is what netavark resolves
#   on nginx-bridge, so the home file's bare `redis` hostname does not work here
#
# redis stays local to this stack: it holds only cache/queue state, starts empty by
# design, and is not worth centralising.
#
# Rootless adaptations:
#   - :Z on the redis data mount (SELinux Enforcing).
#   - No published ports; NPM proxies to http://infisical-backend:8080 over nginx-bridge.
#   - Images start as root and drop privileges internally, so no userns_mode needed.
#
# .env is copied verbatim from home (mode 600) and holds ENCRYPTION_KEY and AUTH_SECRET.
# Those MUST match the database they encrypted -- never regenerate them on migrated data.

networks:
  nginx-bridge:
    external: true

services:
  redis:
    image: docker.io/library/redis:latest
    container_name: infisical-redis
    hostname: infisical-redis
    networks: ["nginx-bridge"]
    env_file: .env
    environment:
      - ALLOW_EMPTY_PASSWORD=yes
      - TZ=America/New_York
    volumes:
      - ./data/redis:/data:Z
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    restart: unless-stopped
    tty: true

  backend:
    image: docker.io/infisical/infisical:latest
    container_name: infisical-backend
    hostname: infisical-backend
    domainname: infisical.gbrown.org
    networks: ["nginx-bridge"]
    env_file: .env
    environment:
      - NODE_ENV=production
      - TZ=America/New_York
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    depends_on:
      - redis
    restart: unless-stopped
    tty: true
    stdin_open: true