services:
  database:
    image: postgres:17
    container_name: coder-database
    restart: unless-stopped
    environment:
      POSTGRES_USER: coder
      POSTGRES_PASSWORD: ${CODER_PG_PASSWORD}
      POSTGRES_DB: coder
    volumes:
      - coder_pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U coder -d coder"]
      interval: 5s
      timeout: 5s
      retries: 12
    mem_limit: 2g

  coder:
    image: ghcr.io/coder/coder:v2.35.3
    container_name: coder
    restart: unless-stopped
    depends_on:
      database:
        condition: service_healthy
    ports:
      - "127.0.0.1:52226:7080"
    environment:
      CODER_HTTP_ADDRESS: 0.0.0.0:7080
      CODER_ACCESS_URL: https://code.loca.zone
      CODER_PG_CONNECTION_URL: postgresql://coder:${CODER_PG_PASSWORD}@database:5432/coder?sslmode=disable
      CODER_TELEMETRY_ENABLE: "false"
      # Authelia OIDC. Password login stays enabled as break-glass, so
      # CODER_DISABLE_PASSWORD_AUTH is deliberately unset. No email-domain
      # restriction: the Authelia user database is the gate.
      CODER_OIDC_ISSUER_URL: https://auth.loca.zone
      CODER_OIDC_CLIENT_ID: coder
      CODER_OIDC_CLIENT_SECRET: ${CODER_OIDC_CLIENT_SECRET}
      CODER_OIDC_SCOPES: openid,profile,email
      CODER_OIDC_SIGN_IN_TEXT: "Sign in with loca.zone SSO"
      # No CODER_WILDCARD_ACCESS_URL. Nested names such as foo.code.loca.zone
      # DO resolve via the *.loca.zone wildcard; the actual blocker is TLS
      # issuance: this lineage covers only code.loca.zone and
      # wiki.code.loca.zone, and a *.code.loca.zone certificate needs DNS-01
      # validation with DNS-provider credentials that are not configured here.
      # Path-based workspace apps and `coder port-forward` are used instead.
    group_add:
      # host gid of /var/run/docker.sock; required so the built-in provisioner
      # can build docker-template workspaces.
      - "105"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - coder_home:/home/coder
    mem_limit: 8g

volumes:
  coder_pgdata:
  coder_home: