secrets:
  STORAGE_ENCRYPTION_KEY:
    file: './secrets/authelia_db_encryption_key'

services:
  authelia:
    image: authelia/authelia:latest
    container_name: authelia
    volumes:
      # Config files are still mounted as volumes
      - ./config/configuration.yml:/config/configuration.yml:ro
      - ./config/users_database.yml:/config/users_database.yml:ro
      
      # Persistent SQLite database directory
      - ./db:/config/db
    ports:
      - '9091:9091'
    secrets: ['STORAGE_ENCRYPTION_KEY']
    environment:
      TZ: 'Etc/UTC'
      AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: '/run/secrets/STORAGE_ENCRYPTION_KEY'
        
    restart: always
    healthcheck:
      test: ["CMD", "authelia", "healthcheck"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 5s