From ade5fa9def99350be8c2188ebb34229d117a9c1a Mon Sep 17 00:00:00 2001
From: Michael Czechowski <mail@dailysh.it>
Date: Wed, 29 Apr 2026 00:59:58 +0200
Subject: [PATCH] feat(deploy): add netcup compose overlay (build local, edge
 net, no host port)

---
 .env.netcup.example | 15 +++++++++++++++
 compose.netcup.yaml | 46 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+)
 create mode 100644 .env.netcup.example
 create mode 100644 compose.netcup.yaml

diff --git a/.env.netcup.example b/.env.netcup.example
new file mode 100644
index 0000000..b32203b
--- /dev/null
+++ b/.env.netcup.example
@@ -0,0 +1,15 @@
+# Server-side .env for netcup deploy. Copy to /srv/librenotes/.env on the host.
+# Used by: docker compose -f docker-compose.yml -f compose.netcup.yaml up -d --build
+
+# Public origin (caddy reverse-proxies to librenotes:8080)
+LIBRENOTES_BASE_URL=https://ln.cloud.librete.ch
+
+# JWT secret — at least 32 bytes. Generate: openssl rand -base64 48
+LIBRENOTES_JWT_SECRET=CHANGE_ME
+
+# SMTP relay (magic-link delivery)
+LIBRENOTES_SMTP_HOST=smtp.example.com
+LIBRENOTES_SMTP_PORT=587
+LIBRENOTES_SMTP_USER=
+LIBRENOTES_SMTP_PASS=
+LIBRENOTES_SMTP_FROM=no-reply@librete.ch
diff --git a/compose.netcup.yaml b/compose.netcup.yaml
new file mode 100644
index 0000000..5449155
--- /dev/null
+++ b/compose.netcup.yaml
@@ -0,0 +1,46 @@
+# compose.netcup.yaml — overlay for the netcup VPS.
+#
+# Use:
+#   docker compose -f docker-compose.yml -f compose.netcup.yaml up -d --build
+#
+# Differences from base docker-compose.yml:
+#   - No host port binding (caddy edge handles ingress)
+#   - Joins external `edge` network so caddy reaches it as `librenotes:8080`
+#   - Pulls config from .env (LIBRENOTES_BASE_URL, JWT_SECRET, SMTP_*)
+#   - Uses bind-mounted /data + /var/lib/librenotes so backups can rsync host paths
+#
+# Inputs (env or .env file on netcup):
+#   LIBRENOTES_BASE_URL     https://ln.cloud.librete.ch
+#   LIBRENOTES_JWT_SECRET   `openssl rand -base64 48`
+#   LIBRENOTES_SMTP_HOST    SMTP relay host
+#   LIBRENOTES_SMTP_PORT    submission port (587 default)
+#   LIBRENOTES_SMTP_USER    SMTP user
+#   LIBRENOTES_SMTP_PASS    SMTP password
+#   LIBRENOTES_SMTP_FROM    no-reply@librete.ch (envelope sender)
+
+services:
+  librenotes:
+    build:
+      context: .
+      args:
+        VERSION: netcup
+    image: librenotes:netcup
+    restart: always
+    ports: !reset []
+    environment:
+      LIBRENOTES_BASE_URL: ${LIBRENOTES_BASE_URL}
+      LIBRENOTES_JWT_SECRET: ${LIBRENOTES_JWT_SECRET}
+      LIBRENOTES_SMTP_HOST: ${LIBRENOTES_SMTP_HOST}
+      LIBRENOTES_SMTP_PORT: ${LIBRENOTES_SMTP_PORT:-587}
+      LIBRENOTES_SMTP_USER: ${LIBRENOTES_SMTP_USER}
+      LIBRENOTES_SMTP_PASS: ${LIBRENOTES_SMTP_PASS}
+      LIBRENOTES_SMTP_FROM: ${LIBRENOTES_SMTP_FROM}
+    volumes: !override
+      - ./data:/data
+      - ./state:/var/lib/librenotes
+    networks:
+      - edge
+
+networks:
+  edge:
+    external: true