docker-compose.yml

services:
  iris:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        # Stamp the deployed bundle with the current commit so already-open
        # tabs detect the redeploy (see UpdateBanner). Deploy with e.g.
        # `IRIS_WEB_BUILD_ID=$(git rev-parse --short HEAD) docker compose up --build -d`.
        # Left empty, Vite falls back to a build timestamp — still unique per build.
        IRIS_WEB_BUILD_ID: ${IRIS_WEB_BUILD_ID:-}
    image: iris:dev
    restart: unless-stopped
    # Pass tracker credentials (TORR9_USERNAME, TORR9_PASSWORD, …) into the container.
    env_file:
      - .env
    environment:
      IRIS_CONFIG: /srv/iris/config/config.toml
      # Always bind to all interfaces inside the container so the port forward works,
      # regardless of what config.toml says.
      IRIS_SERVER__BIND: "0.0.0.0:8080"
      # Serve the bundled React build alongside the API.
      IRIS_SERVER__WEB_DIST: "/srv/iris/web"
      # Public URL — used as the JWT issuer claim. Should be the URL your
      # users actually hit (e.g. your Cloudflare-tunneled hostname). Pulled
      # from .env so changes don't require touching this file.
      IRIS_SERVER__PUBLIC_URL: ${IRIS_SERVER__PUBLIC_URL:-http://localhost:8080}
      # Persist all data into the volume mounted at /data, regardless of the
      # relative paths in config.toml (which target the dev workspace).
      IRIS_STORAGE__DATA_DIR: "/data"
      IRIS_STORAGE__DOWNLOAD_DIR: "/data/downloads"
      IRIS_AUTH__JWT_SECRET: ${IRIS_JWT_SECRET:?set IRIS_JWT_SECRET in .env}
      RUST_LOG: ${RUST_LOG:-info,iris=debug,tower_http=info}
    volumes:
      - ./config:/srv/iris/config:ro
      - iris-data:/data
    ports:
      - "${IRIS_BIND_PORT:-8080}:8080"
      # Pinned BitTorrent listen port — forwarded so inbound peer connections
      # actually reach librqbit (matters for download speed AND ratio on
      # private trackers).
      - "${IRIS_TORRENT_PORT:-45100}:45100/tcp"
      - "${IRIS_TORRENT_PORT:-45100}:45100/udp"
    healthcheck:
      test: ["CMD", "/usr/local/bin/iris", "--help"]
      interval: 30s
      timeout: 5s
      retries: 3

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "${CADDY_HTTP_PORT:-80}:80"
      - "${CADDY_HTTPS_PORT:-443}:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    depends_on:
      - iris
    profiles: ["proxy"]

  # Named Cloudflare tunnel — gives Iris a stable public URL on a domain you
  # control, no port-forwarding required. Set up:
  #   1. https://one.dash.cloudflare.com/ → Networks → Tunnels → "Create"
  #   2. Copy the tunnel TOKEN into .env as CLOUDFLARE_TUNNEL_TOKEN
  #   3. In the tunnel's "Public Hostname" tab, add your hostname pointing at
  #      service "http://iris:8080" (Cloudflare will resolve `iris` over the
  #      compose network).
  #   4. Run with: `just deploy` (docker compose --profile cloudflared up -d)
  #
  # The `cloudflared` profile keeps this OUT of a plain `docker compose up` /
  # `just dev`, so local dev never dials the tunnel. The token deliberately
  # uses `:-` (not `:?`): Compose interpolates the WHOLE file even for
  # profile-disabled services, so a hard `:?` would break every compose
  # command on machines without the token in .env. The fail-loudly check
  # lives in the `just deploy` recipe instead — the only path that enables
  # the profile.
  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    # `--protocol http2` forces HTTP/2 instead of QUIC. QUIC uses UDP/7844
    # outbound which is often dropped by ISPs, NAT or Docker Desktop on
    # macOS. Symptom: repeated `failed to dial to edge with quic: timeout`.
    command: tunnel --no-autoupdate --protocol http2 run
    environment:
      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN:-}
      TUNNEL_TRANSPORT_PROTOCOL: http2
    depends_on:
      - iris
    profiles: ["cloudflared"]

volumes:
  iris-data:
  caddy-data:
  caddy-config: