compose.yml

# SPDX-License-Identifier: MIT
# Copyright (c) 2026 Netresearch DTT GmbH

# compose.yml — production Snipe-IT stack
#
# Services:
#   db          — mariadb:11, binlog enabled (PITR-ready)
#   valkey      — valkey:9-alpine, cache + sessions + queues (RESP-compatible)
#   app-assets  — one-shot init: syncs Snipe-IT's public/ assets into a
#                 shared volume so nginx can serve them
#   app         — our php-fpm image (Snipe-IT code, no nginx)
#   web         — nginx:alpine, serves static + fastcgi -> app:9000
#   scheduler   — ofelia (Netresearch's fork), label-driven cron for both
#                 `artisan schedule:run` (per minute) and `phpbu` (nightly)
#   backup      — phpbu-docker, nightly DB dump + uploads/storage archives
#
# Quickstart:
#   1. cp .env.example .env  &&  edit .env
#   2. docker compose up -d
#   3. docker compose logs -f app
#   4. open APP_URL
#
# Dev overrides (mailpit, exposed db, debug PHP):
#   cp compose.override.yml.example compose.override.yml
#
# TLS / reverse proxy: see examples/compose.traefik.yml etc.
#
# Resource limits (mem_limit / cpus): sized for a small-org deployment
# (single host, <=100 users). They are intentionally explicit & visible so
# operators can tune them. For larger fleets, raise:
#   - db.mem_limit (InnoDB buffer pool scales with dataset)
#   - app.mem_limit (php-fpm pm.max_children * memory_limit; default 25*512M)
#   - app.cpus     (more workers = more CPU)
# Without these limits a stuck php-fpm pool can theoretically allocate
# 25 * 512M = 12.5 GB and OOM the host.
#
# Logging: all services use json-file with 10m * 5 file rotation via the
# x-logging anchor below. Override per-service if you need different sizing
# or a different driver (journald, fluentd, ...).

name: snipe-it

# Shared logging policy — json-file with size-based rotation, keeps the
# host disk safe from unbounded container log growth. 10 MiB per file,
# max 5 files = 50 MiB cap per container.
x-logging: &logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

# Shared environment between app + scheduler-driven exec (both need full env
# to be able to talk to db / redis / mail).
x-app-env: &app-env
  # APP_KEY / DB_PASSWORD / DB_ROOT_PASSWORD are populated by `make init` —
  # the app entrypoint refuses to start with empty values, so we don't
  # repeat the validation here.
  APP_KEY: ${APP_KEY:-}
  APP_URL: ${APP_URL:-http://localhost:8000}
  APP_ENV: ${APP_ENV:-production}
  APP_DEBUG: ${APP_DEBUG:-false}
  # TZ sets the OS clock (cron/log timestamps inside the container).
  # APP_TIMEZONE is what Laravel/Snipe-IT actually reads for date/time
  # display (config/app.php). Keep them in sync by defaulting
  # APP_TIMEZONE to TZ — operators set one var, both honour it.
  TZ: ${TZ:-UTC}
  APP_TIMEZONE: ${APP_TIMEZONE:-${TZ:-UTC}}
  # Pipe Laravel logs to container stdout in JSON — `docker compose logs app`
  # now shows app errors instead of leaving them in a volume nobody checks.
  LOG_CHANNEL: ${LOG_CHANNEL:-stderr}
  LOG_STDERR_FORMATTER: ${LOG_STDERR_FORMATTER:-Monolog\Formatter\JsonFormatter}
  # Secure session cookie ON by default. Override to false ONLY in dev
  # where you serve plain HTTP locally.
  #
  # Snipe-IT reads this variable as SECURE_COOKIES (not the more
  # Laravel-conventional SESSION_SECURE_COOKIE). The fallback chain
  # is deliberately NOT extended to SESSION_SECURE_COOKIE — that would
  # let an operator who explicitly set SESSION_SECURE_COOKIE=false in
  # .env (when the variable was still a no-op) silently disable secure
  # cookies. Operators must rename the variable in .env themselves.
  SECURE_COOKIES: ${SECURE_COOKIES:-true}
  DB_CONNECTION: mysql
  DB_HOST: db
  DB_PORT: 3306
  DB_DATABASE: ${DB_DATABASE:-snipeit}
  DB_USERNAME: ${DB_USERNAME:-snipeit}
  DB_PASSWORD: ${DB_PASSWORD:-}
  # Valkey speaks the RESP protocol — Laravel's "redis" driver works as-is.
  REDIS_HOST: valkey
  REDIS_PORT: 6379
  REDIS_PASSWORD: ${REDIS_PASSWORD:-}
  CACHE_DRIVER: ${CACHE_DRIVER:-redis}
  SESSION_DRIVER: ${SESSION_DRIVER:-redis}
  QUEUE_CONNECTION: ${QUEUE_CONNECTION:-redis}
  MAIL_HOST: ${MAIL_HOST:-}
  MAIL_PORT: ${MAIL_PORT:-587}
  MAIL_USERNAME: ${MAIL_USERNAME:-}
  MAIL_PASSWORD: ${MAIL_PASSWORD:-}
  MAIL_ENCRYPTION: ${MAIL_ENCRYPTION:-tls}
  MAIL_FROM_ADDR: ${MAIL_FROM_ADDR:-noreply@example.com}
  MAIL_FROM_NAME: ${MAIL_FROM_NAME:-Snipe-IT}
  # Sentry / Bugsink error tracking. Empty = SDK loaded but inactive (no
  # network calls, no reports sent). Set to a Sentry- or Bugsink-DSN to
  # enable: http(s)://<key>@<host>/<project-id> (http:// for the in-stack
  # Bugsink overlay, https:// for external/TLS-terminated instances).
  # Sample rates default to 0 (errors only); raise SENTRY_TRACES_SAMPLE_RATE
  # / SENTRY_PROFILES_SAMPLE_RATE to capture performance data if your
  # Bugsink instance is sized for the traffic.
  SENTRY_LARAVEL_DSN: ${SENTRY_LARAVEL_DSN:-}
  SENTRY_TRACES_SAMPLE_RATE: ${SENTRY_TRACES_SAMPLE_RATE:-0.0}
  SENTRY_PROFILES_SAMPLE_RATE: ${SENTRY_PROFILES_SAMPLE_RATE:-0.0}

services:
  # ---------------------------------------------------------------------
  # Database
  # ---------------------------------------------------------------------
  db:
    image: mariadb:11
    restart: unless-stopped
    mem_limit: 2g
    cpus: 2.0
    logging: *logging
    environment:
      # Populated by `make init`; mariadb refuses to start with empty root
      # password — the failure is loud and the runbook clear.
      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:-}
      MARIADB_DATABASE: ${DB_DATABASE:-snipeit}
      MARIADB_USER: ${DB_USERNAME:-snipeit}
      MARIADB_PASSWORD: ${DB_PASSWORD:-}
      MARIADB_AUTO_UPGRADE: "1"
      TZ: ${TZ:-UTC}
    # sync_binlog=1 + innodb_flush_log_at_trx_commit=1 trade throughput for
    # durability: every committed transaction is fsync'd to disk before the
    # client sees the ACK, so a power loss cannot lose writes the binlog
    # already advertised. Required for PITR to be honest. If your org needs
    # higher write throughput and can tolerate losing ~1s of writes on crash,
    # set both back to 0 (or 2 for innodb_flush_log_at_trx_commit) — pair with
    # a UPS / battery-backed cache for safety.
    command:
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
      - --log-bin=mariadb-bin
      - --binlog-format=ROW
      # --expire-logs-days was deprecated in MariaDB 10.6+; the new knob
      # takes seconds. 1209600s = 14 days, same retention as before.
      - --binlog_expire_logs_seconds=1209600
      - --sync_binlog=1
      - --innodb_flush_log_at_trx_commit=1
      - --server-id=1
    volumes:
      - db-data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      # 60s (was 30s) — first-run mysql_install_db on slow disks can exceed
      # 30s; the longer grace prevents the initial healthcheck loop from
      # marking the container unhealthy during legitimate bootstrap.
      start_period: 60s
      retries: 6
    security_opt:
      - no-new-privileges:true
    networks:
      - snipeit

  # ---------------------------------------------------------------------
  # Valkey — cache + sessions + queues
  # Linux-Foundation Redis fork. Drop-in compatible; Laravel still uses
  # the "redis" driver name (RESP protocol).
  # ---------------------------------------------------------------------
  valkey:
    image: valkey/valkey:9-alpine
    restart: unless-stopped
    mem_limit: 384m
    cpus: 0.5
    logging: *logging
    # AOF-only persistence: appendonly=yes + appendfsync=everysec gives
    # at-most-1s of write loss on crash, with bounded fsync overhead. We
    # explicitly disable RDB snapshots (--save "") because running both
    # doubles fsync load and the AOF alone is sufficient for cache + session
    # state. `--appendfsync everysec` is the upstream default; pinned here
    # so future image bumps can't silently change it.
    command:
      - valkey-server
      - --appendonly
      - "yes"
      - --appendfsync
      - everysec
      - --save
      - ""
      - --maxmemory
      - 256mb
      - --maxmemory-policy
      - allkeys-lru
    environment:
      TZ: ${TZ:-UTC}
    volumes:
      - valkey-data:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
    security_opt:
      - no-new-privileges:true
    networks:
      - snipeit

  # ---------------------------------------------------------------------
  # Init: sync Snipe-IT's public/ assets into the shared volume
  # nginx serves these read-only. Runs once on every `up`; idempotent.
  # ---------------------------------------------------------------------
  app-assets:
    image: ghcr.io/netresearch/snipe-it-php-fpm:${SNIPE_IT_IMAGE_TAG:-latest}
    restart: "no"
    mem_limit: 128m
    cpus: 0.25
    logging: *logging
    entrypoint: ["/bin/sh", "-c"]
    # Asset sync — two-phase to minimise the window where nginx can serve
    # partially-synced files during an upgrade.
    #
    # Phase 1: stage the new tree into /shared-public/.new/ (same volume, so
    #          no cross-device copy; existing /shared-public/* keeps serving).
    # Phase 2: for each top-level entry, rename(2) it into place atomically
    #          and remove the previous entry. POSIX rename within the same
    #          filesystem is atomic per-entry, so any given URL transitions
    #          old→new in a single syscall.
    #
    # Residual race: we cannot atomically swap the whole tree (you can't
    # rename(2) the mount point itself, and the assets directory contains
    # ~hundreds of files). During a single sync run there is a brief window
    # — bounded by the number of top-level entries × rename latency, not by
    # tree size — where /shared-public mixes old and new entries. nginx may
    # serve a request that references an old CSS file and a new JS file
    # within that window. For Snipe-IT releases this is acceptable: assets
    # are versioned-hash filenames in the mix-manifest, so the only realistic
    # mismatch is during the brief swap, not for arbitrary later requests.
    # If you require strict atomicity, front nginx with a blue/green deploy.
    command:
      - |
        set -eu
        STAGE=/shared-public/.new
        rm -rf "$$STAGE"
        mkdir -p "$$STAGE"
        cp -a /var/www/html/public/. "$$STAGE"/
        # Atomic per-entry swap: for each top-level child of the staging dir
        # mv it into /shared-public/ replacing the old entry. mv across the
        # same mount is rename(2) — single-syscall atomic per entry.
        for entry in "$$STAGE"/* "$$STAGE"/.[!.]*; do
          [ -e "$$entry" ] || continue
          name=$$(basename "$$entry")
          rm -rf "/shared-public/$$name"
          mv "$$entry" "/shared-public/$$name"
        done
        rmdir "$$STAGE" 2>/dev/null || rm -rf "$$STAGE"
        echo "[app-assets] synced $$(ls /shared-public | wc -l) entries"
    volumes:
      - app-public:/shared-public
    networks:
      - snipeit

  # ---------------------------------------------------------------------
  # App — php-fpm with Snipe-IT
  #
  # Hardened: same posture as `web` — no-new-privileges, cap_drop ALL with
  # the minimum re-adds php-fpm needs for chown/setuid, tmpfs for /tmp and
  # /run/php-fpm (the unix socket lives in a shared tmpfs that `web` also
  # mounts read-only).
  # ---------------------------------------------------------------------
  app:
    image: ghcr.io/netresearch/snipe-it-php-fpm:${SNIPE_IT_IMAGE_TAG:-latest}
    restart: unless-stopped
    mem_limit: 1.5g
    cpus: 2.0
    logging: *logging
    depends_on:
      db:
        condition: service_healthy
      valkey:
        condition: service_healthy
    environment:
      <<: *app-env
      SKIP_MIGRATIONS: ${SKIP_MIGRATIONS:-false}
    volumes:
      - app-data:/var/lib/snipeit             # uploads / user content
      - app-storage:/var/www/html/storage     # Laravel storage (logs, cache, backups)
      - fpm-sock:/run/php-fpm                 # php-fpm unix socket (shared with `web`)
    healthcheck:
      # Composite check:
      #   1. php-fpm /ping returns "pong" (the daemon is alive & accepting work)
      #   2. /var/www/html/storage/framework/scheduler-heartbeat is no older
      #      than 180s — ofelia's snipeit-heartbeat job (see labels below)
      #      touches it every minute. A stale file means the scheduler died
      #      or lost the docker socket and `schedule:run` is no longer firing.
      # The "$$" escapes the literal $ from compose's variable interpolation
      # so the shell receives "$(...)" and "$(( ... ))" as runtime expansions.
      # busybox `stat -c%Y` and `date +%s` are both available in the alpine
      # base image we ship.
      test:
        - CMD-SHELL
        - 'SCRIPT_NAME=/ping SCRIPT_FILENAME=/ping REQUEST_METHOD=GET cgi-fcgi -bind -connect /run/php-fpm/snipeit.sock 2>/dev/null | grep -q pong && test "$$(date +%s)" -le "$$(( $$(stat -c%Y /var/www/html/storage/framework/scheduler-heartbeat 2>/dev/null || echo 0) + 180 ))"'
      interval: 30s
      timeout: 10s
      # 180s minimum so the snipeit-heartbeat ofelia job (@every 1m) has at
      # least one cycle to write the heartbeat file before the freshness
      # gate starts counting failures.
      start_period: 180s
      retries: 3
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN          # entrypoint chowns storage volume to www-data
      - DAC_OVERRIDE   # entrypoint accesses files across uid boundaries
      - FOWNER         # entrypoint chmods storage volume
      - SETUID         # su-exec drops to www-data
      - SETGID         # su-exec drops to www-data
      - KILL           # php-fpm sends signals to workers
    tmpfs:
      - /tmp:mode=1777,size=128M,noexec,nosuid,nodev
      # Mitigation for M1: `php artisan config:cache` writes generated PHP
      # to bootstrap/cache/. Backing it with tmpfs prevents attacker-written
      # PHP from persisting across restarts via the app-storage volume, even
      # if opcache's validate_timestamps=0 would otherwise re-execute it.
      # The entrypoint rebuilds the cache on every container start, so this
      # is functionally equivalent to a persistent mount.
      - /var/www/html/bootstrap/cache:mode=0755,size=32M,nosuid,nodev
    labels:
      # ofelia picks these up via the docker socket and runs them on a
      # schedule inside *this* container.
      ofelia.enabled: "true"
      ofelia.job-exec.snipeit-schedule.schedule: "@every 1m"
      ofelia.job-exec.snipeit-schedule.user: "www-data"
      ofelia.job-exec.snipeit-schedule.command: 'php /var/www/html/artisan schedule:run --no-interaction --quiet'
      # Liveness heartbeat — touches a file on the app-storage volume every
      # minute. The app healthcheck reads the file's mtime and fails if it
      # falls behind by >180s, surfacing scheduler/docker-socket failures
      # as container unhealth (and thus `docker compose ps` red). The
      # heartbeat job is intentionally independent from `schedule:run`: a
      # bug in artisan won't suppress the heartbeat, so we only flag the
      # scheduler *infrastructure* as down — not application errors.
      ofelia.job-exec.snipeit-heartbeat.schedule: "@every 1m"
      ofelia.job-exec.snipeit-heartbeat.user: "www-data"
      ofelia.job-exec.snipeit-heartbeat.command: 'sh -c "mkdir -p /var/www/html/storage/framework && touch /var/www/html/storage/framework/scheduler-heartbeat"'
    networks:
      - snipeit

  # ---------------------------------------------------------------------
  # Web — nginx, serves static + reverse-proxies PHP to app:9000
  # ---------------------------------------------------------------------
  web:
    image: nginx:alpine
    restart: unless-stopped
    mem_limit: 128m
    cpus: 0.5
    logging: *logging
    depends_on:
      app-assets:
        condition: service_completed_successfully
      app:
        condition: service_healthy
    environment:
      # Propagate TZ so access/error log timestamps line up with app/db/backup.
      TZ: ${TZ:-UTC}
    volumes:
      - app-public:/var/www/html/public:ro
      - app-storage:/var/www/html/storage:ro
      # NOT :ro — unix-socket connect() needs write to the socket file, and
      # docker's :ro flag blocks that even when the socket mode allows it.
      - fpm-sock:/run/php-fpm                  # consume php-fpm socket
      - ./config/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./config/nginx/conf.d/default.conf:/etc/nginx/conf.d/default.conf:ro
      # security-headers.conf is `include`d by every location block in
      # default.conf — must be mounted or nginx fails to start.
      - ./config/nginx/snippets:/etc/nginx/snippets:ro
    ports:
      - "${SNIPEIT_HTTP_PORT:-8000}:80"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "--spider", "http://127.0.0.1/health"]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - SETUID
      - SETGID
      - NET_BIND_SERVICE
    tmpfs:
      - /tmp:mode=1777,size=64M,noexec,nosuid,nodev
      - /var/cache/nginx:mode=0755,size=64M,nosuid,nodev
      - /var/run:mode=0755,size=8M,nosuid,nodev
    networks:
      - snipeit

  # ---------------------------------------------------------------------
  # Worker — long-running `php artisan queue:work` daemon. Consumes jobs
  # that the `app` service (web requests) and `scheduler` service
  # (cron-driven `schedule:run`) dispatch to valkey via Laravel's redis
  # queue driver.
  #
  # Without this service, jobs would land in valkey but never run —
  # emails would be dispatched-but-never-sent, EOL reminders would be
  # queued-but-never-delivered, etc. So this service is what makes
  # QUEUE_CONNECTION=redis functional end-to-end.
  #
  # Same image as `app` (snipe-it-php-fpm), but the CMD overrides php-fpm
  # with `php artisan queue:work`. The container's entrypoint still runs
  # — that handles DB-wait + Passport key check — but SKIP_MIGRATIONS is
  # set true so the worker doesn't race with `app` on schema migration.
  # `depends_on: app: service_healthy` guarantees migrations + cache
  # warmup are done by `app` before the worker boots.
  #
  # Self-recycling flags:
  #   --memory=128       restart if RSS exceeds 128 MiB (defends against
  #                       long-running-process memory leaks)
  #   --max-jobs=1000    restart after 1000 jobs (same idea, job-count
  #                       axis)
  #   --max-time=3600    restart after 1h wall clock (third axis)
  #   --tries=3          retry failed jobs 3× before pushing to
  #                       failed_jobs table
  #   --timeout=120      kill jobs running >120s (prevents one stuck
  #                       SMTP/SOAP call from blocking the queue)
  #   --sleep=3          sleep 3s when queue is empty (vs busy-loop)
  # `restart: unless-stopped` plus the above flags = self-healing daemon.
  # ---------------------------------------------------------------------
  worker:
    image: ghcr.io/netresearch/snipe-it-php-fpm:${SNIPE_IT_IMAGE_TAG:-latest}
    restart: unless-stopped
    mem_limit: 256m
    cpus: 0.5
    logging: *logging
    depends_on:
      db:
        condition: service_healthy
      valkey:
        condition: service_healthy
      app:
        condition: service_healthy
    environment:
      <<: *app-env
      # Skip migrations + cache rebuild — `app` already did those. Avoids
      # a worker boot racing with app on the same migration / wiping the
      # app's freshly-warmed bootstrap cache.
      SKIP_MIGRATIONS: "true"
    command:
      - php
      - artisan
      - queue:work
      - --tries=3
      - --timeout=120
      - --memory=128
      - --sleep=3
      - --max-jobs=1000
      - --max-time=3600
    volumes:
      - app-data:/var/lib/snipeit             # uploads (jobs may read attached files for emails)
      - app-storage:/var/www/html/storage     # Laravel storage (logs, framework cache)
    healthcheck:
      # `queue:work` runs as www-data after entrypoint's su-exec. pgrep
      # without a UID filter catches both the entrypoint shell (during
      # boot) and the running queue:work process — either means "alive"
      # for healthcheck purposes.
      test: ["CMD-SHELL", "pgrep -f 'artisan queue:work' >/dev/null"]
      interval: 30s
      timeout: 5s
      # 120s start_period covers the entrypoint's DB-wait + Passport
      # check + cache rebuild before queue:work actually starts.
      start_period: 120s
      retries: 3
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN          # entrypoint chowns storage volume to www-data
      - DAC_OVERRIDE   # entrypoint accesses files across uid boundaries
      - FOWNER         # entrypoint chmods storage volume
      - SETUID         # su-exec drops to www-data
      - SETGID         # su-exec drops to www-data
    tmpfs:
      - /tmp:mode=1777,size=64M,noexec,nosuid,nodev
    networks:
      - snipeit

  # ---------------------------------------------------------------------
  # Scheduler — ofelia (Netresearch's fork) drives Laravel's schedule
  # AND the nightly phpbu backup, via labels on the target services.
  # Mounts the host docker socket read-only so it can `docker exec`.
  # ---------------------------------------------------------------------
  scheduler:
    image: ghcr.io/netresearch/ofelia:latest
    restart: unless-stopped
    mem_limit: 64m
    cpus: 0.25
    logging: *logging
    depends_on:
      app:
        condition: service_started
      backup:
        condition: service_started
    # `--docker` flag was removed in newer ofelia — docker socket integration
    # is the default. The mount below is what enables it.
    command: ["daemon"]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    security_opt:
      - no-new-privileges:true
    networks:
      - snipeit

  # ---------------------------------------------------------------------
  # Backup — phpbu (Netresearch's hardened image) dumps the DB and
  # archives uploads + storage volumes nightly. Container idles between
  # runs; ofelia execs phpbu via the labels below.
  #
  # Configure off-host destination by bind-mounting `./backups` to a
  # mounted share (NAS, NFS) — or remove the bind-mount and rely on
  # restic/rclone running on the host side reading from the named volume.
  # ---------------------------------------------------------------------
  backup:
    image: ghcr.io/netresearch/phpbu-docker:latest
    restart: unless-stopped
    mem_limit: 256m
    cpus: 0.5
    logging: *logging
    depends_on:
      db:
        condition: service_healthy
    environment:
      DB_HOST: db
      DB_DATABASE: ${DB_DATABASE:-snipeit}
      DB_USERNAME: ${DB_USERNAME:-snipeit}
      DB_PASSWORD: ${DB_PASSWORD:-}
      TZ: ${TZ:-UTC}
      # phpbu emits a failure email to BACKUP_ALERT_TO when set. Leave empty
      # to disable. SMTP creds reused from the app's MAIL_* config.
      BACKUP_ALERT_TO: ${BACKUP_ALERT_TO:-}
      MAIL_HOST: ${MAIL_HOST:-}
      MAIL_PORT: ${MAIL_PORT:-587}
      MAIL_USERNAME: ${MAIL_USERNAME:-}
      MAIL_PASSWORD: ${MAIL_PASSWORD:-}
      MAIL_ENCRYPTION: ${MAIL_ENCRYPTION:-tls}
      MAIL_FROM_ADDR: ${MAIL_FROM_ADDR:-noreply@example.com}
      MAIL_FROM_NAME: ${MAIL_FROM_NAME:-Snipe-IT Backup}
    volumes:
      - ./config/phpbu/backup.json:/config/backup.json:ro
      - app-storage:/snapshot/storage:ro
      - app-data:/snapshot/data:ro
      - backups:/backups
    # The phpbu-docker image's default ENTRYPOINT runs `phpbu "$@"` and
    # exits. We need the container to stay alive so ofelia can `docker
    # exec` phpbu into it on a cron schedule. Replace entrypoint with an
    # idle loop that also writes the TZ ini that the image's entrypoint
    # would have created (so phpbu's timestamps land in the right zone).
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        set -eu
        mkdir -p /backups/db /backups/uploads /backups/storage
        if [ -n "${TZ:-}" ]; then
          printf 'date.timezone = %s\n' "$TZ" > /usr/local/etc/php/conf.d/tz.ini
        fi
        exec tail -f /dev/null
    healthcheck:
      # phpbu lives at /app/vendor/bin/phpbu (not on PATH). Test the
      # binary is invokable as a healthcheck proxy.
      test: ["CMD", "/app/vendor/bin/phpbu", "--version"]
      interval: 60s
      timeout: 10s
      start_period: 15s
      retries: 3
    security_opt:
      - no-new-privileges:true
    labels:
      ofelia.enabled: "true"
      ofelia.job-exec.snipeit-backup.schedule: "0 0 3 * * *"
      ofelia.job-exec.snipeit-backup.command: '/app/vendor/bin/phpbu --configuration=/config/backup.json'
    networks:
      - snipeit

volumes:
  db-data:
    name: snipeit-db-data
  valkey-data:
    name: snipeit-valkey-data
  app-data:
    name: snipeit-app-data
  app-storage:
    name: snipeit-app-storage
  app-public:
    name: snipeit-app-public
  backups:
    name: snipeit-backups
  # tmpfs-backed shared volume for the php-fpm unix socket; populated by
  # `app` at startup, consumed read-only by `web`.
  fpm-sock:
    name: snipeit-fpm-sock
    driver_opts:
      type: tmpfs
      device: tmpfs
      o: "size=8m,mode=0755"

networks:
  snipeit:
    name: snipeit
    driver: bridge