services:
  server:
    image: docker.io/actualbudget/actual-server:25.5.0@sha256:3b486fbc0db02839917f65ed277aa509980f710b6e96dde966f5219983978179
    environment:
      - ACTUAL_LOGIN_METHOD=openid
      - ACTUAL_OPENID_DISCOVERY_URL=${DC_ACTUAL_OPENID_DISCOVERY_URL:?}
      - ACTUAL_OPENID_CLIENT_ID=${DC_ACTUAL_OPENID_CLIENT_ID:?}
      - ACTUAL_OPENID_CLIENT_SECRET=${DC_ACTUAL_OPENID_CLIENT_SECRET:?}
      - ACTUAL_OPENID_SERVER_HOSTNAME=https://${DC_ACTUAL_HOSTNAME:?}
      - ACTUAL_OPENID_ENFORCE=true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.actual.rule=Host(`${DC_ACTUAL_HOSTNAME:?}`)"
      - "traefik.http.routers.actual.entrypoints=websecure"
      - "traefik.http.services.actual.loadbalancer.server.port=${DC_ACTUAL_PORT:?}"
    networks:
      - traefik

    volumes:
      - data:/data
    healthcheck:
      # Enable health check for the instance
      test: ['CMD-SHELL', 'node src/scripts/health-check.js']
      interval: 60s
      timeout: 10s
      retries: 3
      start_period: 20s
    restart: unless-stopped

volumes:
  data:

networks:
  traefik:
    external: true