docker-compose.yaml

# Default/local stack. Mirrors the architecture of docker-compose.rpi.yaml:
#   - SQLite (embedded) instead of a MongoDB container.
#   - nginx builds and serves the static React app; no Node runtime container.
# For the lean, hardened Raspberry Pi deployment use docker-compose.rpi.yaml.

services:
  pastebin-api:
    build:
      context: ./pastebin-api
      dockerfile: Dockerfile
    expose:
      - "8080"
    environment:
      # Binds 8080 by default; set PORT to override.
      - WORKER_THREADS=${WORKER_THREADS:-8}
      - SQLITE_PATH=/data/db/pastebin.db
      - BLOB_STORAGE_PATH=/data/blobs
      - ACCESS_LOG_PATH=/data/logs/access.log
      - MAX_REQUEST_BYTES=${MAX_REQUEST_BYTES:-53477376}
      - RATE_LIMIT_GLOBAL_CONCURRENCY=${RATE_LIMIT_GLOBAL_CONCURRENCY:-30}
      - MAX_FILE_UPLOAD_BYTES=${MAX_FILE_UPLOAD_BYTES:-52428800}
      - MAX_STORAGE_BYTES_PER_IP=${MAX_STORAGE_BYTES_PER_IP:-104857600}
      # Admin endpoints require this token via X-Admin-Token. Unset ⇒ admin API disabled (fail-closed).
      - ADMIN_TOKEN=${ADMIN_TOKEN:-}
    volumes:
      - blob-data:/data/blobs
      - db-data:/data/db
      - log-data:/data/logs
    networks:
      - pastebin-network

  nginx:
    build:
      context: .
      dockerfile: nginx/Dockerfile
    container_name: pastebin-nginx
    # Plain HTTP only — mirrors the Pi, where Tailscale Funnel terminates TLS upstream.
    # Override the host port for local dev, e.g. PASTEBIN_HTTP_PORT=8080 docker compose up.
    ports:
      - "${PASTEBIN_HTTP_PORT:-80}:80"
    depends_on:
      - pastebin-api
    networks:
      - pastebin-network
    restart: unless-stopped

volumes:
  db-data:
  blob-data:
  log-data:

networks:
  pastebin-network:
    driver: bridge