# OpenMFA — single-container deployment.
#
#   docker compose up -d
#
# Then open http://<this-host>:8720/ and complete first-run setup.
#
# No special networking: outbound HTTPS to Discord, Slack or Telegram, and
# one served HTTP port. Bridge mode is fine.

services:
  openmfa:
    image: gitea.milesward.dev/mward4/openmfa:latest
    container_name: openmfa
    restart: unless-stopped
    ports:
      - "8720:8720"
    environment:
      OPENMFA_HTTP_ADDR: "0.0.0.0:8720"
      OPENMFA_LOG: "info,openmfa=info"
      # Optional. Supply a base64 32-byte key to keep the vault key OFF the
      # data volume — then a leaked copy of the volume is useless on its own.
      # Generate one with:  openssl rand -base64 32
      # If unset, a key is generated into the volume as `vault.key` (0600).
      # OPENMFA_MASTER_KEY: "…"
    volumes:
      # Vault, key, admin account and settings. Back this up — losing it
      # loses every stored TOTP secret.
      - ./data/work:/var/lib/openmfa
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8720/healthz"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 5s