docker-compose.yml

services:
  nginx:
    image: nginx:alpine
    container_name: mailguard-nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certs:/etc/nginx/certs:ro
    depends_on:
      - mailguard-pro
    restart: unless-stopped

  db:
    image: postgres:15-alpine
    container_name: mailguard-postgres
    environment:
      - POSTGRES_USER=mailguard
      - POSTGRES_PASSWORD=mailguard_pass
      - POSTGRES_DB=mailguard
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped

  mailguard-pro:
    build: .
    container_name: mailguard-pro
    ports:
      - "3000:3000"
      - "53:5353/udp" # host DNS port 53 -> unprivileged sinkhole 5353 in the container
    environment:
      - DEMO_MODE=true # Change to false and set IMAP creds for live mode
      - NODE_ENV=production
      - SINKHOLE_PORT=5353 # keep the sinkhole on an unprivileged port (container runs as non-root)
      # ── Authentication (enabled by default) ──
      # Pin a password + secret for a stable, non-generated login:
      # - AUTH_PASSWORD=change-me-please
      # - AUTH_SECRET=replace-with-a-long-random-string
      # Restrict CORS to your dashboard origin if serving cross-origin:
      # - CORS_ORIGIN=https://mailguard.example.com
      # ── Live Gmail (optional) ──
      # - IMAP_USER=your_email@gmail.com
      # - IMAP_PASSWORD=your_app_password
      # ── Database ──
      - DB_CLIENT=pg
      - DB_HOST=db
      - DB_USER=mailguard
      - DB_PASS=mailguard_pass
      - DB_NAME=mailguard
    depends_on:
      - db
    volumes:
      - ./server/data:/app/server/data # persists the SQLite DB (if used) + seed JSON
    restart: unless-stopped

volumes:
  postgres_data: