name: qsfera-pi

services:
  qsfera:
    image: ${QSFERA_IMAGE:?Set QSFERA_IMAGE to a pinned ARM64 image tag}
    platform: linux/arm64
    init: true
    entrypoint:
      - /bin/sh
    command:
      - -ec
      - |
        if [ ! -f /etc/qsfera/qsfera.yaml ]; then
          qsfera init
        fi
        exec qsfera server
    environment:
      OC_BASE_DATA_PATH: /var/lib/qsfera
      OC_CONFIG_DIR: /etc/qsfera
      OC_URL: ${QSFERA_URL:?Set QSFERA_URL to the public server URL}
      OC_LOG_LEVEL: ${QSFERA_LOG_LEVEL:-info}
      OC_LOG_COLOR: "false"
      OC_LOG_PRETTY: "false"
      OC_INSECURE: "${QSFERA_INSECURE:-false}"
      PROXY_TLS: "${QSFERA_PROXY_TLS:-true}"
      PROXY_ENABLE_BASIC_AUTH: "${QSFERA_ENABLE_BASIC_AUTH:-false}"
      IDM_ADMIN_PASSWORD: ${QSFERA_ADMIN_PASSWORD:?Set a strong QSFERA_ADMIN_PASSWORD}
      IDM_CREATE_DEMO_USERS: "false"
    ports:
      - "${QSFERA_BIND_IP:-127.0.0.1}:9200:9200"
    volumes:
      - type: bind
        source: ${QSFERA_CONFIG_DIR:?Set QSFERA_CONFIG_DIR to a persistent directory}
        target: /etc/qsfera
      - type: bind
        source: ${QSFERA_DATA_DIR:?Set QSFERA_DATA_DIR to a persistent directory}
        target: /var/lib/qsfera
    mem_limit: "${QSFERA_MEMORY_LIMIT:?Set QSFERA_MEMORY_LIMIT after measuring available RAM}"
    healthcheck:
      test:
        - CMD-SHELL
        - 'scheme=https; [ "$${PROXY_TLS}" = "false" ] && scheme=http; curl --fail --silent --show-error --insecure "$${scheme}://127.0.0.1:9200/status.php" >/dev/null'
    security_opt:
      - no-new-privileges:true
    logging:
      driver: local
    restart: unless-stopped