services:
  webmail:
    image: ghcr.io/bulwarkmail/webmail:latest
    ports:
      - "3000:3000"
    environment:
      - HOSTNAME=0.0.0.0 # Use "::" for IPv6
      - PORT=3000
    env_file:
      - .env.local
    volumes:
      # These six volumes together are everything Bulwark keeps under /app/data.
      # A fresh install can use one `bulwark-data:/app/data` volume instead.
      #
      # Encrypted user settings (SETTINGS_DATA_DIR).
      - bulwark-settings:/app/data/settings
      # Admin configuration: config.json, policy.json, admin.json (passwordHash),
      # plugins, themes, branding uploads (ADMIN_CONFIG_DIR). Can be mounted
      # read-only after running the setup wizard - append `:ro` to lock it.
      - bulwark-admin:/app/data/admin
      # Admin runtime state: admin-state.json (login timestamps), audit.log,
      # setup token (ADMIN_STATE_DIR). Always read-write.
      - bulwark-admin-state:/app/data/admin-state
      # Anonymous telemetry: instance id, consent state, login HMACs (TELEMETRY_DATA_DIR).
      # Persisting this preserves the admin's consent choice and stable instance id across upgrades.
      - bulwark-telemetry:/app/data/telemetry
      # Users' plugin credentials, encrypted (PLUGIN_SECRETS_DIR).
      - bulwark-plugin-secrets:/app/data/plugin-secrets
      # Result of the last update check (VERSION_CHECK_DATA_DIR).
      - bulwark-version-check:/app/data/version-check
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://127.0.0.1:3000/api/health",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped

volumes:
  bulwark-settings:
  bulwark-admin:
  bulwark-admin-state:
  bulwark-telemetry:
  bulwark-plugin-secrets:
  bulwark-version-check: