services:
  coder:
    image: ghcr.io/coder/coder:latest
    container_name: coder
    restart: unless-stopped
    ports:
      - "7080:7080"
    environment:
      CODER_HTTP_ADDRESS: "0.0.0.0:7080"
      CODER_ACCESS_URL: "https://dev.nuclide.systems"
      CODER_WILDCARD_ACCESS_URL: "*.dev.nuclide.systems"
      CODER_PG_CONNECTION_URL: "postgresql://coder:${CODER_DB_PASSWORD}@192.168.1.6:5432/coder?sslmode=disable"
      # OIDC via Pocket-ID
      CODER_OIDC_ISSUER_URL: "https://id.nuclide.systems"
      CODER_OIDC_CLIENT_ID: "${CODER_OIDC_CLIENT_ID}"
      CODER_OIDC_CLIENT_SECRET: "${CODER_OIDC_CLIENT_SECRET}"
      CODER_OIDC_ALLOW_SIGNUPS: "true"
      CODER_OIDC_EMAIL_DOMAIN: "nucli.de"
      CODER_DISABLE_PASSWORD_AUTH: "true"
      # Disable the bundled GitHub login provider (separate from OIDC)
      CODER_OAUTH2_GITHUB_DEFAULT_PROVIDER_ENABLE: "false"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /mnt/pve/unas/services/coder:/home/coder
    group_add:
      - "991"  # docker socket gid inside CT 111
volumes: