# Managed by Ansible (roles/signal_api)
services:
  {{ signal_api_service_name }}:
    image: {{ signal_api_image }}
    container_name: {{ signal_api_service_name }}
    restart: unless-stopped

    environment:
      MODE: "{{ signal_api_mode }}"

    volumes:
      # Prefer IPv4. See gai.conf.j2 - without this, signal-cli reaches for
      # chat.signal.org's IPv6 address, which is unreachable from here, and
      # linking fails with an opaque "network error" on the phone.
      - {{ signal_api_dir }}/gai.conf:/etc/gai.conf:ro
      # Holds the Signal identity: the linked-device keys and registration
      # state. Lose this and the device must be linked again by scanning a new
      # QR code from the phone. It is also the most sensitive thing on this
      # host - anyone with these keys can send and read Signal as you.
      - {{ signal_api_data_dir }}:/home/.local/share/signal-cli

    networks:
      - {{ signal_api_network }}

    # NO PORTS. Deliberately.
    #
    # This API has no authentication whatsoever - no key, no token, nothing.
    # Publishing it, even on 127.0.0.1, would expose "send a Signal message as
    # this identity" to anything that can reach the host. Gatus talks to it over
    # the shared docker network by service name instead, which is why no port is
    # published and why there is no Caddy vhost.

    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8080/v1/health"]
      interval: 60s
      timeout: 5s
      retries: 3

    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

networks:
  {{ signal_api_network }}:
    external: true