services:
  app:
    image: docker.io/actualbudget/actual-server:latest-alpine
    environment:
      - ACTUAL_PORT=5006
      - ACTUAL_OPENID_DISCOVERY_URL=https://auth.routinedevelopment.ca/.well-known/openid-configuration
      - ACTUAL_OPENID_CLIENT_ID=${OPENID_CLIENT_ID}
      - ACTUAL_OPENID_CLIENT_SECRET=${OPENID_CLIENT_SECRET}
      - ACTUAL_OPENID_SERVER_HOSTNAME=https://personal-budget.routinedevelopment.ca
      - ACTUAL_OPENID_ENFORCE=true
      - ACTUAL_USER_CREATION_MODE=login
    volumes:
      - actual-data:/data
    networks:
      - dokploy-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.actual.rule=Host(`personal-budget.routinedevelopment.ca`)"
      - "traefik.http.routers.actual.entrypoints=websecure"
      - "traefik.http.routers.actual.tls.certresolver=letsencrypt"
      - "traefik.http.services.actual.loadbalancer.server.port=5006"
    healthcheck:
      test: ['CMD-SHELL', 'node src/scripts/health-check.js']
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 20s
    restart: unless-stopped

volumes:
  actual-data:

networks:
  dokploy-network:
    external: true