# The bundled tracker (slice 1, row S3, REQ-TASK-3): the unmodified upstream
# Vikunja image, pinned by digest, published on 127.0.0.1 only. No Vikunja
# code and no secret is in the repository. The data directory, the env file
# with VIKUNJA_SERVICE_SECRET and the uid come from the operator; README.md
# in this directory has the steps. tests/deploy.test.mjs checks the digest
# and the bind address.
name: mosaic-vikunja
services:
  vikunja:
    image: vikunja/vikunja@sha256:e2204a1c1c6a81e833c2b3a5442be182ca2335b54c2e7e37578cc3fe12a27cfc
    container_name: mosaic-vikunja
    restart: unless-stopped
    # The container runs as the operator, so the mounts stay theirs.
    user: "${MOSAIC_VIKUNJA_UID:?set MOSAIC_VIKUNJA_UID}:${MOSAIC_VIKUNJA_GID:?set MOSAIC_VIKUNJA_GID}"
    ports:
      - "127.0.0.1:${MOSAIC_VIKUNJA_PORT:-3456}:3456"
    env_file:
      - "${MOSAIC_VIKUNJA_DIR:?set MOSAIC_VIKUNJA_DIR}/env"
    environment:
      VIKUNJA_DATABASE_TYPE: sqlite
      VIKUNJA_DATABASE_PATH: /db/vikunja.db
      VIKUNJA_WEBHOOKS_ENABLED: "false"
      VIKUNJA_SERVICE_ENABLEREGISTRATION: "false"
    # Both mounts are required: /app/vikunja isn't writable to the
    # operator's uid, and Vikunja's startup check writes to files/.
    volumes:
      - "${MOSAIC_VIKUNJA_DIR:?set MOSAIC_VIKUNJA_DIR}/db:/db"
      - "${MOSAIC_VIKUNJA_DIR:?set MOSAIC_VIKUNJA_DIR}/files:/app/vikunja/files"