version: '3.8'

# Organizr - Unified Dashboard with Tabbed Interface
# "One page to rule them all" - Tabs for all services in single interface
# Phase 3.5: Unified Access Layer
# Ports: 9999 (Web UI)
# GPU: No
# Storage: SSD (configs and user data)

services:
  organizr:
    image: organizr/organizr:latest
    container_name: organizr
    restart: unless-stopped
    ports:
      - "9999:80"
    volumes:
      # SSD storage for configs and user data
      - /home/jpmschweitzer/docker-data/organizr:/config
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Amsterdam
      - fpm=true  # Enable PHP-FPM for better performance
      - DB_TYPE=pgsql
      - DB_HOST=postgres-shared
      - DB_PORT=5432
      - DB_NAME=organizr
      - DB_USER=organizr_user
      - DB_PASS=${ORGANIZR_DB_PASSWORD}
    networks:
      - docker-dataplane

networks:
  docker-dataplane:
    external: true
    name: docker-dataplane

# Setup Instructions:
# 1. Ensure tower-of-joy is connected to Headscale mesh (get mesh IP)
# 2. Deploy this stack: make deploy-organizr
# 3. Access via mesh IP: http://10.99.0.1:9999 (or local: http://192.168.86.149:9999)
# 4. Complete setup wizard
# 5. Add tabs using MESH IPs for VPN access:
#    - Portainer: http://10.99.0.1:8001
#    - Uptime Kuma: http://10.99.0.1:3001
#    - Netdata: http://10.99.0.1:19999
#    - Heimdall: http://10.99.0.1:8888
#    - Jellyfin: http://10.99.0.1:8096 (when deployed)
#    - Nextcloud: http://10.99.0.1:8082 (when deployed)
#
# Access Pattern (Option B - Hybrid):
#   VPN Access (Primary - Admin Tools):
#   - Connect to Headscale VPN
#   - Access Organizr: http://10.99.0.1:9999
#   - All tabs use mesh IPs (10.99.0.x)
#   - Secure, no public exposure
#
#   Public Access (Media/Files Only):
#   - https://home.schweitz.net → Organizr (optional public)
#   - https://media.schweitz.net → Jellyfin
#   - https://cloud.schweitz.net → Nextcloud
#   - Admin tools NOT accessible without VPN
#
# Mesh IP Benefits:
# - Works from anywhere (VPN connected)
# - No complex proxy rewrites needed
# - Secure by default
# - Easy device addition
#
# Important Notes:
# - Use mesh IPs (10.99.0.x) instead of local IPs (192.168.86.x)
# - Some services may block iframe embedding (X-Frame-Options header)
# - Organizr authentication secures public access
# - See docs/mesh-access-strategy.md for complete guide