# ZenBooks self-hosting - docker-compose.yml
#
# Put this file and .env (copied from env.example, see below) in the same empty folder, then run
# `docker compose up -d`. Nothing else is needed - the app image is pulled automatically from
# Docker Hub (no build step, no source checkout), and it imports its own database schema on first
# boot against the empty MariaDB instance below - no separate schema file to download.

services:
  mariadb:
    image: mariadb:11
    container_name: zenbooks-mariadb
    environment:
      - MARIADB_DATABASE=${DB_NAME:-accountor}
      - MARIADB_USER=${DB_USER:-accountor}
      - MARIADB_PASSWORD=${DB_PASSWORD:?set DB_PASSWORD in .env}
      - MARIADB_ROOT_PASSWORD=${DB_ROOT_PASSWORD:?set DB_ROOT_PASSWORD in .env}
    volumes:
      - db-data:/var/lib/mysql
    healthcheck:
      # --innodb_initialized specifically (not just --connect) matters on a *first* boot against
      # an empty volume: the server can already be accepting connections while MariaDB's own
      # first-boot initialization is still running, which briefly restarts mysqld partway through
      # - a plain --connect check can report healthy in that gap, right before the restart drops
      # it again. (The zenbooks service's own schema import happens after this passes, over an
      # ordinary connection, so it doesn't add another such gap of its own.)
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 30s
    restart: unless-stopped

  zenbooks:
    container_name: zenbooks
    image: makershop/zenbooks:${TAG:-latest}
    depends_on:
      mariadb:
        condition: service_healthy
    environment:
      - DB_HOST=mariadb
      - DB_PORT=3306
      - DB_NAME=${DB_NAME:-accountor}
      - DB_USER=${DB_USER:-accountor}
      - DB_PASSWORD=${DB_PASSWORD:?set DB_PASSWORD in .env}
      - PORT=8000
      # Only needed if you configure an SFTP backup destination, or want to save a license key
      # (Admin -> Users -> License) - either way, any string works, it's just used to derive the
      # encryption key. Leave unset if you don't use either.
      - BACKUP_ENCRYPTION_KEY=${BACKUP_ENCRYPTION_KEY:-}
      # Points this install at your ZenBooks account (this site) for license-key verification
      # and the sign-in dialog's "start a free trial" / "use your license key" options.
      - LICENSE_SERVER_URL=${LICENSE_SERVER_URL:-}
      # Optional software-vendor identifiers for Maventa/Apix/Vero e-invoicing and tax-filing
      # integrations - not per-company secrets, see env.example for what each one does. All are
      # optional; each integration still works unset, just unattributed to a known vendor.
      - MAVENTA_VENDOR_API_KEY=${MAVENTA_VENDOR_API_KEY:-}
      - APIX_SOFTWARE_NAME=${APIX_SOFTWARE_NAME:-}
      - APIX_SOFTWARE_VERSION=${APIX_SOFTWARE_VERSION:-}
      - VERO_API_SOFTWARE_ID=${VERO_API_SOFTWARE_ID:-}
      - VERO_API_VENDOR_KEY=${VERO_API_VENDOR_KEY:-}
      # Vero mTLS cert/key (Test/verification + Production filing, see env.example) - paths point
      # inside the read-only bind mount below. VERO_CERTS_DIR defaults to ./vero-certs (an empty
      # folder you create yourself, next to this file) - point it at wherever your real cert/key
      # files actually live to activate Test/Production.
      - VERO_MTLS_KEY_PATH=/app/backend/vero-certs/${VERO_MTLS_KEY_FILE:-avain.pem}
      - VERO_MTLS_KEY_PASSPHRASE=${VERO_MTLS_KEY_PASSPHRASE:-}
      - VERO_MTLS_TEST_CERT_PATH=/app/backend/vero-certs/${VERO_MTLS_TEST_CERT_FILE:-certificate_vero_test.pem}
      - VERO_MTLS_PRODUCTION_CERT_PATH=/app/backend/vero-certs/${VERO_MTLS_PRODUCTION_CERT_FILE:-certificate_vero_prod.pem}
    volumes:
      - ${VERO_CERTS_DIR:-./vero-certs}:/app/backend/vero-certs:ro
      # Persists uploaded voucher attachments (receipts) across container recreation.
      - uploads-data:/app/backend/uploads
      # Default local backup destination path (Admin -> Scheduled Backups -> Destinations ->
      # "Local / mounted path"). A named volume works out of the box, but for a real backup
      # server/network drive, replace this line with a bind mount instead, e.g.:
      # - /mnt/backup-server/zenbooks:/app/backend/backups:z
      - backups-data:/app/backend/backups
    ports:
      - "${PORT:-8080}:8000"
    restart: unless-stopped

volumes:
  db-data:
  uploads-data:
  backups-data:
