docker-compose.yml

services:
  hydra:
    image: ghcr.io/zaydiscold/hydra:latest
    build: .
    # init:true provides Docker-native tini equivalent — properly forwards
    # SIGTERM to Node + Chromium, reaps zombie processes (Gotcha #2)
    init: true
    ports:
      - "3001:3001"
    volumes:
      # LOCAL USE: bind mount uses your actual ./data directory (DB, secrets, session state).
      # This is why Docker has your accounts and doesn't prompt for new login.
      # For server deployment: swap to named volume (see DOCKER_PLAN.md § "Volume strategy")
      - ./data:/app/data
    # RAM-backed tmpfs for /tmp — prevents UnionFS (Overlay2) exhaustion from
    # Playwright debug traces/network logs when HYDRA_PROVISION_NETWORK_LOG=1.
    # tmpfs is not a volume — it's a per-container RAM mount, cleared on stop. (Gotcha #7)
    tmpfs:
      - /tmp:size=256m,mode=1777
    environment:
      - NODE_ENV=production
      - DATABASE_URL=file:/app/data/hydra.db
      - HYDRA_PLAYWRIGHT_NO_SANDBOX=1
      - HYDRA_DOCKERIZED=1
      # Bind inside the container to all interfaces so Docker port publishing can reach Hydra.
      - HYDRA_LISTEN_HOST=0.0.0.0
      # WARNING: Setting these to 1 on a persistent container will fill /tmp
      # with Playwright traces and network logs. Use 0 in production. (Gotcha #7)
      - HYDRA_PROVISION_NETWORK_LOG=0
      - HYDRA_PROVISION_DEBUG=0
    restart: unless-stopped
    # NOTE: If you need external webhook ingress (e.g., Clerk push events),
    # you must expose this container to the internet via Cloudflare Tunnels
    # (cloudflared) or Ngrok. Docker NAT blocks inbound hooks. (Gotcha #8)
    #
    # WARNING: Running on a public VPS (DigitalOcean, AWS, Linode) changes
    # your IP ASN to a datacenter range. Cloudflare may trigger Turnstile
    # CAPTCHAs or 403 responses for automated Playwright provisioning.
    # Consider routing through a residential proxy for account generation. (Gotcha #5)