# Discord Authenticator — single-container deployment.
#
#   docker compose up -d
#
# Then open http://<this-host>:8710/ and complete first-run setup.
#
# Unlike a PXE server this needs no special networking: it makes outbound
# HTTPS calls to Discord and serves one HTTP port. Bridge mode is fine.

services:
  discord-authenticator:
    image: gitea.milesward.dev/mward4/discord-authenticator:latest
    container_name: discord-authenticator
    restart: unless-stopped
    ports:
      - "8710:8710"
    environment:
      DA_HTTP_ADDR: "0.0.0.0:8710"
      DA_LOG: "info,da=info"
      # Optional. Supply a base64 32-byte key to keep the vault key OFF the
      # data volume — then a leaked copy of the volume is useless on its own.
      # Generate one with:  openssl rand -base64 32
      # If unset, a key is generated into the volume as `vault.key` (0600).
      # DA_MASTER_KEY: "…"
    volumes:
      # Vault, key, admin account and settings. Back this up — losing it
      # loses every stored TOTP secret.
      - ./data/work:/var/lib/discord-authenticator
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8710/healthz"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5s