# Example stack. nadir-agent runs on each managed host, not here — this is just the web UI.
# Secrets come from a .env file next to this one (see .env.example), never committed.
services:
  nadir-frontend:
    # pull from your private registry, or `docker compose build` locally
    image: uraniadev/nadir:latest
    container_name: nadir-webui
    build: .
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      ORIGIN: ${ORIGIN:-http://localhost:3000}
      CRYPTO_SECRET: ${CRYPTO_SECRET:?set CRYPTO_SECRET in .env (openssl rand -base64 32)}
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:?set BETTER_AUTH_SECRET in .env (openssl rand -base64 32)}
    volumes:
      - nadir-db:/app/data # db.sqlite folder

volumes:
  nadir-db: