services:
  espresso-frame-server:
    # Pushed to a LAN-local registry, not git.thumeit.com -- see
    # .gitea/workflows/server-docker-build.yml's comment (Cloudflare's
    # payload-size limit in front of that host started rejecting pushes
    # once whiteboard mode's Node/native-binding layers made the image
    # much bigger).
    image: 10.0.0.246:3000/tfaour/espresso-frame-server:latest
    build: .
    ports:
      - "8420:8420"
    volumes:
      - ./data:/data
    environment:
      - CONFIG_PATH=/data/config.json
      - IMMICH_URL=http://your-immich-host:2283
      - IMMICH_API_KEY=your-immich-api-key-here
      # Optional: gates the entire server -- the web UI (/, /api/*) AND
      # every device-facing /frame/* endpoint -- behind this shared secret.
      # Leave unset to keep it all open on a trusted LAN, same as before.
      # Paste the same value into the ESP32's captive portal setup form
      # (Access Token field) so it's sent on every device request and gets
      # embedded automatically in the manage-menu/share QR codes.
      - MANAGEMENT_TOKEN=changeme
      # Optional: only needed if the Gitea repo configured in the web UI's
      # "Firmware Gitea repo URL" field is private. A read-only PAT is
      # enough -- it's sent to that repo's releases API/asset downloads
      # only, never exposed via the web UI or any API response.
      - GITEA_FIRMWARE_TOKEN=your-gitea-pat-here
    restart: unless-stopped