service:
  name: nextcloud
  # TODO DECYZJA OSKARA: owner_node — piha (always-on, ciasno) vs solaria
  # (mocna, sesyjna). Modul 4 / kb-02 sklaniaja sie ku SOLARIA: KB-kopia
  # dokumentow i tak lezy w archiwum na PIHA, wiec zapytania KB dzialaja bez
  # Nextclouda; sync z telefonu dogania sie po wybudzeniu hosta.
  owner_node: solaria
  role: file-sync-drive         # Drive replacement + WebDAV source for KB ingest (archiwum = KOPIA)
  exposure: private             # LAN/Tailscale only via npm@PIHA (cloud.kapala.org); NO public ingress
  dependencies:
    - forgejo                   # OIDC identity provider (forgejo.kapala.org), app user_oidc
  ports:
    - container: 80
      host: 8220                # LAN_BIND_IP only, never 0.0.0.0
      protocol: tcp
  healthcheck:
    type: http
    endpoint: http://localhost:8220/status.php   # use the node's LAN bind IP — localhost does not answer
    interval: 30s
    timeout: 10s
    retries: 5
  restart_policy: unless-stopped
  persistence:
    # Nextcloud = KOPIA in the kb-02 hybrid: KB snapshots files at ingest, so
    # this data is NOT the KB source of truth. Backup is "warto" (user data),
    # not a KB boundary condition like paperless.
    paths:
      - /opt/homelab/data/nextcloud/html    # app + config + user files (html/data/)
      - /opt/homelab/data/nextcloud/db      # postgres data
  runtime:
    config_files:
      - .env                    # secrets (gitignored, from env.example)
    env_vars:
      - LAN_BIND_IP             # required — LAN IP of the CHOSEN host node
      - TRUSTED_PROXIES         # npm@PIHA as seen from this node
      - POSTGRES_PASSWORD
      - NEXTCLOUD_ADMIN_USER    # bootstrap admin (before OIDC is wired)
      - NEXTCLOUD_ADMIN_PASSWORD