services:
  server:
    image: docker.io/actualbudget/actual-server:25.6.1@sha256:cb23c488bb517550dea10f42ae9a69c2e746fc2736b068e8c4cc2a224641222f
    environment:
      - ACTUAL_LOGIN_METHOD=openid
      - ACTUAL_OPENID_DISCOVERY_URL=${DC_ACTUAL_OPENID_DISCOVERY_URL:?}
      - ACTUAL_OPENID_CLIENT_ID=${DC_ACTUAL_OPENID_CLIENT_ID:?}
      - ACTUAL_OPENID_CLIENT_SECRET=${DC_ACTUAL_OPENID_CLIENT_SECRET:?}
      - ACTUAL_OPENID_SERVER_HOSTNAME=https://${DC_ACTUAL_HOSTNAME:?}
      - ACTUAL_OPENID_ENFORCE=true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.actual.rule=Host(`${DC_ACTUAL_HOSTNAME:?}`)"
      - "traefik.http.routers.actual.entrypoints=websecure"
      - "traefik.http.services.actual.loadbalancer.server.port=${DC_ACTUAL_PORT:?}"
    networks:
      - traefik

    volumes:
      - data:/data
    healthcheck:
      # Enable health check for the instance
      test: ['CMD-SHELL', 'node src/scripts/health-check.js']
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 20s
    restart: unless-stopped

volumes:
  data:

networks:
  traefik:
    external: true