name: syncthing

# Always-on Syncthing peer and off-site copy for the owner's folders. The web
# GUI is reachable only through the central Caddy proxy on proxy_net (the GUI
# port is never published); the sync protocol is published directly on host
# 22000 so devices connect to the droplet without going through relays. See
# README.md for the deploy, upgrade, and pairing runbook.

services:
  syncthing:
    image: syncthing/syncthing:latest
    restart: unless-stopped
    hostname: droplet
    environment:
      # Own the bind-mounted files as the droplet's deploy user so synced data
      # is inspectable and manageable over plain SSH.
      PUID: "1000"
      PGID: "1000"
      # Bind the GUI to all interfaces inside the container so Caddy can reach
      # it over proxy_net. The port is deliberately not published to the host;
      # Syncthing's own credentials are the only thing guarding this surface.
      STGUIADDRESS: "0.0.0.0:8384"
    volumes:
      # Config (device keys, folder list) and all folder data live here, on a
      # host bind mount, so everything survives recreation and is visible over
      # SSH. Git-ignored via the repo's data/ rule.
      - ./data:/var/syncthing
    ports:
      # Sync protocol only. Device IDs authenticate the protocol, so exposing
      # this publicly is safe by design. No local-discovery port (21027/udp) is
      # published: it is useless on a public server with no LAN peers.
      - "22000:22000/tcp"
      - "22000:22000/udp"
    mem_limit: 512m
    networks:
      - proxy_net

networks:
  proxy_net:
    external: true