services:
  openbao:
    image: openbao/openbao:2.5.5
    container_name: openbao
    restart: unless-stopped
    # The image entrypoint already runs `bao server -config=/openbao/config`
    # (the whole config dir), so we only pass the subcommand here.
    command: server
    ports:
      # Plaintext API bound to loopback only — local CLI/admin use. LAN clients
      # reach OpenBAO via Traefik (TLS) at https://openbao.famfi.home instead.
      - "127.0.0.1:8200:8200"
    environment:
      BAO_ADDR: "http://127.0.0.1:8200"
    networks:
      - default
      - traefik_proxy
    volumes:
      - ./config:/openbao/config:ro
      - openbao-data:/openbao/file
    healthcheck:
      # 200 = unsealed+active. Accept sealed (501) and standby (429) too,
      # so the container is "healthy" once the API is responding at all.
      test: ["CMD", "bao", "status", "-address=http://127.0.0.1:8200"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 10s

networks:
  # Project-internal network (default).
  default:
  # Shared with the Traefik stack so Traefik can reach this container by name
  # (http://openbao:8200). Created by the Traefik compose project.
  traefik_proxy:
    external: true

volumes:
  openbao-data: