service:
  name: nextcloud
  # Decyzja Oskara: PIHA (nie SOLARIA). Uzasadnienie: Nextcloud jest uzywany
  # aktywnie (telefon, sync, rodzina) -> musi byc always-on, sesyjna
  # dostepnosc SOLARII nie jest akceptowalna dla tego workloadu (w
  # przeciwienstwie do KB-zapytan, ktore i tak czytaja wlasna kopie z
  # archiwum na PIHA niezaleznie od hosta Nextclouda). Patrz
  # docs/kb/modules/DECYZJE-do-podjecia.md #1 i README.md.
  owner_node: piha
  role: file-sync-drive         # Drive replacement + WebDAV source for KB ingest (archiwum = KOPIA)
  exposure: private             # LAN/Tailscale only via npm@PIHA (cloud.kapala.org); NO public ingress
  dependencies:
    - forgejo                   # OIDC identity provider (forgejo.kapala.org), app user_oidc
  ports:
    - container: 80
      host: 8220                # LAN_BIND_IP only, never 0.0.0.0
      protocol: tcp
  healthcheck:
    type: http
    endpoint: http://localhost:8220/status.php   # use the node's LAN bind IP — localhost does not answer
    interval: 30s
    timeout: 10s
    retries: 5
  restart_policy: unless-stopped
  persistence:
    # Nextcloud = KOPIA in the kb-02 hybrid: KB snapshots files at ingest, so
    # this data is NOT the KB source of truth. Backup is "warto" (user data),
    # not a KB boundary condition like paperless.
    paths:
      - /opt/homelab/data/nextcloud/html    # app + config + user files (html/data/)
      - /opt/homelab/data/nextcloud/db      # postgres data
  runtime:
    config_files:
      - .env                    # secrets (gitignored, from env.example)
    env_vars:
      - LAN_BIND_IP             # required — LAN IP of the CHOSEN host node
      - TRUSTED_PROXIES         # npm@PIHA as seen from this node
      - POSTGRES_PASSWORD
      - NEXTCLOUD_ADMIN_USER    # bootstrap admin (before OIDC is wired)
      - NEXTCLOUD_ADMIN_PASSWORD