# SQLInsight Hub with PostgreSQL. Put a TLS-terminating reverse proxy (IIS/ARR, nginx, Caddy, Traefik) in front:
# agents and staff must reach the hub over https.
#
#   HUB_DB_PASSWORD=... docker compose up -d
#   docker compose exec hub dotnet SQLInsight.Hub.dll add-staff <brugernavn> "<navn>"
services:
  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: sqlinsight_hub
      POSTGRES_USER: sqlinsight_hub
      POSTGRES_PASSWORD: ${HUB_DB_PASSWORD:?set HUB_DB_PASSWORD}
    volumes:
      - postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U sqlinsight_hub -d sqlinsight_hub"]
      interval: 10s
      retries: 5

  hub:
    build:
      context: ../..
      dockerfile: deploy/hub/Dockerfile
    image: sqlinsight-hub
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      ConnectionStrings__Hub: "Host=postgres;Database=sqlinsight_hub;Username=sqlinsight_hub;Password=${HUB_DB_PASSWORD};GSS Encryption Mode=Disable"
      # The public key licenses are signed with (the vendor tool's keygen prints it):
      # SQLInsight__Hub__TrustedKeys__k20260929: "MFkw..."
      SQLInsight__Hub__UpdateFeedPath: /data/feed
      # Address of the reverse proxy, so login rate limiting sees real client addresses:
      # SQLInsight__Hub__KnownProxies__0: "172.18.0.1"
    volumes:
      - hubdata:/data
    ports:
      - "127.0.0.1:8080:8080"

volumes:
  postgres:
  hubdata: