docker-compose.yml

services:
  sqldb:
    image: mysql:8.3
    restart: unless-stopped
    ports:
      - "3306:3306"
    environment:
      - MYSQL_DATABASE=${MYSQL_DATABASE:-kimai}
      - MYSQL_USER=${MYSQL_USER:-kimai}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:-kimai}
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:-rootpassword}
    volumes:
      - mysql:/var/lib/mysql
    command: --default-storage-engine innodb
    healthcheck:
      test: mysqladmin -p$$MYSQL_ROOT_PASSWORD ping -h localhost
      interval: 20s
      start_period: 10s
      timeout: 10s
      retries: 3
    networks:
      - caddy_net

  kimai:
    build:
      context: .
      dockerfile: Dockerfile.prod
    restart: unless-stopped
    ports:
      - "8001:8001"
    depends_on:
      sqldb:
        condition: service_healthy
    environment:
      # Database connection
      DATABASE_URL: ${DATABASE_URL:-mysql://${DATABASE_USER:-kimai}:${DATABASE_PASSWORD:-kimai}@sqldb/${DATABASE_NAME:-kimai}?charset=utf8mb4&serverVersion=8.3.0}

      # Initial admin user (created on first run)
      ADMINMAIL: ${ADMINMAIL:-admin@example.com}
      ADMINPASS: ${ADMINPASS:-changemeonlogin}

      # Application settings
      APP_SECRET: ${APP_SECRET}
      TRUSTED_HOSTS: ${TRUSTED_HOSTS:-localhost,127.0.0.1}

      # Email settings (optional, can be configured later)
      MAILER_FROM: ${MAILER_FROM:-kimai@example.com}
      MAILER_URL: ${MAILER_URL:-null://null}

      # Webhook settings (optional)
      WEBHOOK_URL: ${WEBHOOK_URL:-}
      WEBHOOK_SECRET: ${WEBHOOK_SECRET:-}

      # Notion integration (optional)
      NOTION_API_KEY: ${NOTION_API_KEY:-}
      NOTION_PROJECT_DATABASE_ID: ${NOTION_PROJECT_DATABASE_ID:-}
      NOTION_TIME_ENTRY_DATABASE_ID: ${NOTION_TIME_ENTRY_DATABASE_ID:-}
      NOTION_TASK_DATABASE_ID: ${NOTION_TASK_DATABASE_ID:-}
      NOTION_WORKSPACE: ${NOTION_WORKSPACE:-}
    volumes:
      # Only persist truly dynamic data
      - kimai_logs:/opt/kimai/var/logs
      - kimai_cache:/opt/kimai/var/cache
      - kimai_data:/opt/kimai/var/data
      - kimai_sessions:/opt/kimai/var/sessions
    # Base image uses curl http://127.0.0.1:8001; Symfony TRUSTED_HOSTS often lists
    # "localhost" but not "127.0.0.1", which yields HTTP 400 and permanent "unhealthy".
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS -H 'Host: localhost' http://127.0.0.1:8001/ -o /dev/null || exit 1",
        ]
      interval: 20s
      timeout: 10s
      retries: 3
      start_period: 90s
    networks:
      - caddy_net

volumes:
  kimai_logs:
  kimai_cache:
  kimai_data:
  kimai_sessions:
  mysql:

networks:
  caddy_net:
    external: true