# OpenNest.Server deployment example: one instance, one local data volume, LAN-only.
# Usage: docker compose --env-file <local-env> -f compose.server.yaml up -d
# Start from OpenNest.Server/server.env.example. See docs/nest-storage.md before deploying.
name: opennest-server
services:
  opennest-server:
    image: ${OPENNEST_SERVER_IMAGE:?Set a tested version or digest}
    restart: unless-stopped
    ports:
      - "${OPENNEST_BIND_ADDRESS:?Set 127.0.0.1 for testing or a trusted LAN address}:${OPENNEST_HOST_PORT:-8090}:8090"
    environment:
      ASPNETCORE_URLS: http://+:8090
      OPENNEST_DB: /app/data/nests.db
      # "off" stops mirroring the desktop update feed from GitHub (clients then check GitHub themselves).
      OPENNEST_UPDATES: ${OPENNEST_UPDATES:-on}
      OPENNEST_JOB_RETENTION_DAYS: ${OPENNEST_JOB_RETENTION_DAYS:-7}
    volumes:
      - opennest-data:/app/data
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  # Server nesting (docs/server-nesting.md): the same image solving queued Auto Nest jobs one
  # at a time. It talks to the server over HTTP and never opens the database, and its own CPU
  # and memory limits keep a large nest from slowing nest open and save. A job has no time
  # limit, so fewer CPUs only make it slower, never a worse nest.
  opennest-worker:
    image: ${OPENNEST_SERVER_IMAGE:?Set a tested version or digest}
    restart: unless-stopped
    depends_on:
      - opennest-server
    environment:
      OPENNEST_ROLE: worker
      OPENNEST_SERVER_URL: http://opennest-server:8090/
    cpus: ${OPENNEST_WORKER_CPUS:-2}
    mem_limit: ${OPENNEST_WORKER_MEMORY:-4g}
    # Time to give a running job back to the queue on stop.
    stop_grace_period: 30s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

volumes:
  opennest-data:
    # A restore switches to a separately verified volume instead of overwriting this one.
    name: ${OPENNEST_DATA_VOLUME:-opennest-data}