services:
  app:
    image: gitea.lokcal.de/loki/mytime:latest
    # Non-root: Prozess läuft als UID:GID 1000:1000, kein root beim Start.
    user: "1000:1000"
    # Binds all host interfaces so devices in the home network can reach
    # the app. Keep this port inside the home network: do not forward it
    # on the internet router, and block it in the host firewall for
    # anything outside the LAN. The app has no login by default
    # (see README, “Anmeldung (optional)”).
    ports:
      # Host-Port bei Bedarf in .env anpassen (APP_PORT=3100)
      - "${APP_PORT:-3000}:3000"
    volumes:
      - ./data:/app/data
      - ./backups:/app/backups
    environment:
      - DATA_DIR=/app/data
      - BACKUPS_DIR=/app/backups
      # Optionale Anmeldung, siehe README (Abschnitt „Anmeldung (optional)").
      - AUTH_MODE=${AUTH_MODE:-off}
      - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-}
      - BETTER_AUTH_URL=${BETTER_AUTH_URL:-}
      - OIDC_DISCOVERY_URL=${OIDC_DISCOVERY_URL:-}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
    restart: unless-stopped