# SilverBullet on the agent host: the operator's view of the vault (L10, M5.4).
# Installed to /opt/stacks/silverbullet by ../setup.sh. No secrets here: its
# accounts are made in its setup wizard and kept in its data folder.
services:
  silverbullet:
    # Pinned: the docker role updates stacks' images nightly, and a pinned
    # version only changes in a PR here.
    image: ghcr.io/silverbulletmd/silverbullet:2.11.1-slim
    restart: unless-stopped
    environment:
      # Only these. Any SB_* setting (even SB_NAME) boots a single space with
      # no accounts, serving /data instead of the vault.
      PUID: "1000"
      PGID: "1000"
    ports:
      # IPv4 only; setup.sh's firewall lets only the operator's Caddy in.
      - "0.0.0.0:3000:3000"
    volumes:
      # Its own accounts and settings.
      - /srv/nisse/silverbullet:/data
      # The vault, the space's folder: the operator writes everything in it...
      - /srv/nisse/vault:/vault
      # ...except the agents' memory, which only the agents write (one writer
      # per folder, enforced by the kernel).
      - /srv/nisse/vault/memory:/vault/memory:ro
    logging:
      driver: journald  # logs go to the host's journal (L12)