name: wisp-hydrant

services:
  hydrant:
    image: ${HYDRANT_IMAGE:?set a revision-pinned Hydrant image}
    container_name: wisp-hydrant
    environment:
      HYDRANT_API_BIND: 0.0.0.0:3000
      HYDRANT_DATABASE_PATH: /data/hydrant.db
      HYDRANT_FULL_NETWORK: "false"
      HYDRANT_EPHEMERAL: "false"
      HYDRANT_ONLY_INDEX_LINKS: "false"
      HYDRANT_VERIFY_SIGNATURES: full
      HYDRANT_VERIFY_CIDS: "true"
      HYDRANT_VERIFY_MST: "true"
      HYDRANT_PLC_URL: https://plc.directory
      HYDRANT_RELAY_HOSTS: wss://relay1.us-east.bsky.network,wss://relay.fire.hose.cam/
      # The by-collection crawler sends these verbatim; wildcards are rejected.
      HYDRANT_FILTER_SIGNALS: place.wisp.fs,place.wisp.subfs,place.wisp.settings,place.wisp.v2.domains,place.wisp.v2.wh
      HYDRANT_FILTER_COLLECTIONS: place.wisp.*
      HYDRANT_CRAWLER_URLS: by_collection::https://lightrail.microcosm.blue
      HYDRANT_ENABLE_CRAWLER: "true"
      HYDRANT_CRAWLER_MAX_PENDING_REPOS: "2000"
      HYDRANT_CRAWLER_RESUME_PENDING_REPOS: "1000"
      HYDRANT_BACKFILL_CONCURRENCY_LIMIT: "16"
      HYDRANT_CACHE_SIZE: "128"
      RUST_LOG: info
    # Management endpoints are unauthenticated: private mesh/tailnet only.
    ports:
      - 100.64.0.11:3010:3000
      - 10.88.0.10:3010:3000
    volumes:
      - hydrant_data:/data
    restart: unless-stopped
    init: true
    stop_grace_period: 2m

volumes:
  hydrant_data:
    external: true
    name: ${HYDRANT_DATA_VOLUME:?set the persistent database volume}