services:
  kopia:
    image: kopia/kopia:latest
    container_name: kopia
    restart: unless-stopped
    user: "0:0"
    hostname: "docker-host"
    ports:
      - "${HTTP_PORT}:51515"
    command:
      - server
      - start
      - --address=0.0.0.0:51515
      - --tls-cert-file=/tls/kopia.crt
      - --tls-key-file=/tls/kopia.key
      - --server-username=${USERNAME}
      - --server-password=${SECRET_PASSWORD}
      - --disable-csrf-token-checks
    environment:
      TZ: ${TZ}
      KOPIA_PASSWORD: ${SECRET_PASSWORD}
    volumes:
      - /path/to/backup-drive/kopia-repo:/repository # External drive for repository
      - /path/to/backup-drive/kopia-cache:/cache
      - /path/to/backup-drive/kopia-config:/app/config
      - /path/to/backup-drive/kopia-tls:/tls:ro
      - /path/to/docker-volumes:/apps:ro # Read-only access to docker volumes
      - /path/to/docker-volumes:/restore
    networks:
      - kopia-net

networks:
  kopia-net:
    external: true