service:
  name: gokapi
  owner_node: vps
  role: public-file-share       # Firefox Send-style link sharing, deliberately separate from Nextcloud
  exposure: public               # public via npm@VPS (share.okit.pl). The container's own port binds
                                  # to TAILSCALE_BIND_IP only, never 0.0.0.0 — npm is the sole public
                                  # entry point (see docker-compose.yml). Same pattern as vikunja.
  dependencies: []                # standalone; npm@VPS proxies to it but gokapi has no upstream deps
  ports:
    - container: 53842
      host: 53842
      protocol: tcp
  healthcheck:
    type: http
    endpoint: http://localhost:53842/     # setup wizard until first admin login, then the login page
    interval: 30s
    timeout: 10s
    retries: 5
  restart_policy: unless-stopped
  persistence:
    paths:
      - /opt/homelab/data/gokapi/data      # uploaded files — ephemeral by design, links expire
      - /opt/homelab/data/gokapi/config    # config.json + E2E encryption master key — BACK THIS UP
  runtime:
    config_files:
      - .env                    # host-local binds + disk-protection tuning (gitignored, from env.example)
    env_vars:
      - TAILSCALE_BIND_IP        # required — mesh-only port bind; npm@VPS reaches it via hairpin NAT
      - GOKAPI_MAX_FILESIZE      # per-file cap in MB — keeps the shared VPS disk from filling
      - GOKAPI_MIN_FREE_SPACE    # MB headroom before uploads are refused
      - GOKAPI_TRUSTED_PROXIES   # npm@VPS as seen through Docker hairpin NAT (docker bridge subnet)
      # No admin/auth env vars: Gokapi has no headless setup — admin account,
      # storage backend, encryption level are all set in the /setup web
      # wizard on first boot (deploy-time step, see README).