services:
  app:
    build:
      context: .
      args:
        VERSION: ${VERSION:-dev}
    environment:
      ADMIN_USER: ${ADMIN_USER:-admin}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set ADMIN_PASSWORD in .env}
      ADDR: ":8080"
      # Inside the container the admin listener must bind the container's own interface; it is not
      # published below, so it stays unreachable from outside without a tunnel or the proxy.
      ADMIN_ADDR: ":8081"
      SECURE_COOKIES: ${SECURE_COOKIES:-true}
      PUBLIC_URL: ${PUBLIC_URL:-}
    # The SQLite file sits in here beside the audio, so this one mount is the whole backup.
    volumes:
      - ./storage:/storage
    ports:
      - "8080:8080"
      - "8081:8081"
    restart: unless-stopped