# SilverBullet on the agent host: the operator's view of the vault (L10, M5.4).
# Installed to /opt/stacks/silverbullet by ../setup.sh. No secrets here: it
# has no accounts of its own; the operator logs in through Authelia, in front of
# it in their Caddy, and only Caddy can reach it (setup.sh's firewall).
services:
  silverbullet:
    # Pinned: the docker role updates stacks' images nightly, and a pinned
    # version only changes in a PR here.
    image: ghcr.io/silverbulletmd/silverbullet:2.11.1-slim
    restart: unless-stopped
    environment:
      PUID: "1000"
      PGID: "1000"
      # Set on purpose: any SB_* setting boots one space, the vault mounted at
      # /data, with no accounts or setup wizard. Without one, an empty vault
      # would boot the wizard instead.
      SB_NAME: Nisse vault
    ports:
      # IPv4 only; setup.sh's firewall lets only the operator's Caddy in.
      - "0.0.0.0:3000:3000"
    volumes:
      # The vault is the space: the operator writes everything in it...
      - /srv/nisse/vault:/data
      # ...except the agents' memory, which only the agents write (one writer
      # per folder, enforced by the kernel).
      - /srv/nisse/vault/memory:/data/memory:ro
    logging:
      driver: journald  # logs go to the host's journal (L12)