services:
  imptune:
    # Pull the published image by default (docker compose pull / up).
    # `build` is kept so `docker compose build` still produces a correctly
    # tagged local image; scripts/publish.ps1 pushes it to the registry.
    image: git.azuze.fr/kawa/imptune:latest
    build: .
    ports:
      - "8000:8000"
    volumes:
      - imptune_data:/data
    restart: unless-stopped
    environment:
      - DATA_DIR=/data
      # Uncomment when this port is reached over plain HTTP (no TLS proxy in
      # front): the owner-session cookie is Secure by default, so the browser
      # drops it and every request mints a new empty Owner. With `false` the
      # session works but lives only until the browser closes, and the UI warns.
      # - COOKIE_SECURE=false
      # Or drop sessions entirely — no cookie, one shared store for everyone who
      # can reach the app. Test boxes / single-person local prod only.
      # - COOKIE_SECURE=single_user
      # Image search / driver-page search / image download are the only outbound
      # requests ImpTune makes. Set false on an air-gapped host and the UI hides
      # those controls instead of timing out on each one.
      # - WEB_SEARCH=false

volumes:
  imptune_data: