---
# signal-cli-rest-api: the transport Gatus uses to send Signal messages.
#
# Gatus does not speak Signal. It POSTs JSON to this service, which holds the
# actual Signal identity and does the protocol work.

# Pinned by digest for the same reason as Gatus: a tag is mutable.
# Upstream publishes no versioned tags worth pinning to, so this pins the
# DIGEST that `latest` resolved to when this was reviewed. `latest` is a moving
# target; a digest is a content address, and `docker compose pull` either
# fetches exactly this image or fails.
signal_api_image_digest: "sha256:2399d449123cdad56c4d859277e3b9127e1a00c4d2ab4601c239882609286cf8"
signal_api_image: "bbernhard/signal-cli-rest-api@{{ signal_api_image_digest }}"

signal_api_dir: /opt/signal-api
signal_api_data_dir: "{{ signal_api_dir }}/data"

# MODE matters on this host. Upstream offers normal / native / json-rpc /
# json-rpc-native. json-rpc keeps a resident JVM daemon and upstream describes it
# as "increased memory" - this VPS has 464MB total and already runs Gatus and
# Caddy, so a resident JVM is not affordable. `native` runs a precompiled
# GraalVM binary per request: no daemon, no resident cost, and alerts are rare
# enough that paying startup per alert is the right trade.
signal_api_mode: native

# Port INSIDE the shared docker network. Never published to the host: this API
# has NO AUTHENTICATION of any kind. Anyone who can reach it can send messages
# as you and read your Signal.
signal_api_port: 8080

# Both this and Gatus join this network so Gatus can reach the API by service
# name. Gatus runs in a container, so the host's loopback is NOT reachable from
# it - this is why a shared network is required rather than a published port.
signal_api_network: monitoring
signal_api_service_name: signal-api

# The uid the upstream image drops to (`setpriv --reuid=1000`). The data
# directory must be owned by it or signal-cli cannot write the account.
signal_api_uid: 1000