docker-compose.yml

name: sebinta

services:
  app:
    build: .
    image: sebinta:latest
    restart: unless-stopped
    environment:
      - SITE_PASSWORD=${SITE_PASSWORD:-}
      - MAX_FILE_SIZE_MB=${MAX_FILE_SIZE_MB:-500}
      - FILE_TTL_DAYS=${FILE_TTL_DAYS:-}
      - COOKIE_SECRET=${COOKIE_SECRET:-}
      - COOKIE_SECURE=${COOKIE_SECURE:-true}
      - PORT=3000
      - NODE_ENV=production
    volumes:
      - sebinta_data:/app/data
      - sebinta_uploads:/app/uploads
    # No "ports": the app isn't exposed directly on the machine. The only
    # access comes from the cloudflared service, over Docker's internal network.
    networks:
      - internal
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:3000/health"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3

  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    # Default mode: "Quick Tunnel" — no Cloudflare account or TUNNEL_TOKEN
    # needed, but gives a random *.trycloudflare.com URL that changes every
    # time the container restarts (no SLA, personal/testing use only).
    #
    # For a named tunnel with a fixed URL (recommended for ongoing use):
    # 1. Follow the README steps to get a TUNNEL_TOKEN.
    # 2. Set TUNNEL_TOKEN in .env.
    # 3. Replace the "command" line below with: command: ["tunnel", "run"]
    #    (cloudflared reads the token automatically from the TUNNEL_TOKEN
    #    environment variable, no need to pass it as an argument).
    command: ["tunnel", "--url", "http://app:3000"]
    depends_on:
      app:
        condition: service_healthy
    networks:
      - internal
    # Also no "ports": cloudflared only makes outbound connections to
    # Cloudflare's network; public HTTPS is handled entirely by them.

networks:
  internal:
    driver: bridge

volumes:
  sebinta_data:
  sebinta_uploads: