docker-compose.yml

# Crew — single-service stack (issue 0009).
# Usage: cp .env.example .env  &&  docker compose up --build
#
# One container, one named volume for the SQLite database. The embedding model is
# baked into the image at build time, so this comes up with no outbound network.

services:
  server:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        VITE_RYBBIT_SITE_ID: ${VITE_RYBBIT_SITE_ID:-}
        VITE_RYBBIT_SCRIPT_SRC: ${VITE_RYBBIT_SCRIPT_SRC:-https://rybbit.missingmounts.com/api/script.js}
    # The container always listens on 8080 internally (Dockerfile PORT default);
    # CREW_HOST_PORT (.env) picks the published host port — 8087 to match the plugin.
    ports:
      - "${CREW_HOST_PORT:-8087}:8080"
    environment:
      # Auth config — see .env / .env.example (ADR 0003). The secret signs
      # sessions; the admin pair seeds the first Admin on a fresh database.
      CREW_AUTH_SECRET: ${CREW_AUTH_SECRET:?set CREW_AUTH_SECRET in .env (copy from .env.example)}
      CREW_ADMIN_EMAIL: ${CREW_ADMIN_EMAIL:?set CREW_ADMIN_EMAIL in .env (copy from .env.example)}
      CREW_ADMIN_PASSWORD: ${CREW_ADMIN_PASSWORD:?set CREW_ADMIN_PASSWORD in .env (copy from .env.example)}
      CREW_ADMIN_NAME: ${CREW_ADMIN_NAME:-Admin}
      # Public origin better-auth builds routes/cookies against (defaults to
      # http://localhost:<PORT> inside the container if unset).
      CREW_BASE_URL: ${CREW_BASE_URL:-}
    volumes:
      # SQLite (+ WAL/SHM) persists here across restarts; CREW_DB_PATH=/data/crew.db
      # is set in the image, so the file lands on this named volume.
      - crew-data:/data
    restart: unless-stopped

volumes:
  crew-data: