service:
  name: vikunja
  owner_node: piha
  exposure: private          # reachable on Tailscale; public via npm reverse proxy
  dependencies:
    - forgejo                 # OIDC identity provider (forgejo.okit.pl)
  ports:
    - container: 3456
      host: 3456
      protocol: tcp
  healthcheck:
    type: http
    endpoint: http://localhost:3456/api/v1/info
    interval: 30s
    timeout: 10s
    retries: 5
  restart_policy: unless-stopped
  persistence:
    # Data lives in pre-existing Docker named volumes — do NOT move/rename.
    paths:
      - vikunja_vikunja_db      # postgres data  -> /var/lib/postgresql/data
      - vikunja_vikunja_files   # uploads        -> /app/vikunja/files
  runtime:
    config_files:
      - config.yml              # OIDC provider metadata (secret-free, in git)
      - .env                    # secrets (gitignored, supplied per node)
    env_vars:
      - POSTGRES_PASSWORD
      - VIKUNJA_DATABASE_PASSWORD
      - VIKUNJA_SERVICE_JWTSECRET
      - VIKUNJA_AUTH_OPENID_PROVIDERS_FORGEJO_CLIENTSECRET