docker-compose.yml

services:
  gmail-cleaner:
    # Option 1: Multi-arch image: works natively on both AMD64 and ARM64 (Apple Silicon)
    image: ghcr.io/gururagavendra/gmail-cleaner:latest
    pull_policy: always

    # Option 2: Build locally (uncomment below, comment out image above)
    # build: .

    # Published ports are bound to host loopback only, so the API is not exposed
    # to the local network by default. To reach it from other machines, drop the
    # "127.0.0.1:" prefix AND set API_TOKEN below (see environment).
    ports:
      - "127.0.0.1:8766:8766"  # Web UI
      - "127.0.0.1:8767:8767"  # OAuth callback
    volumes:
      - type: bind
        source: ./credentials.json
        target: /app/credentials.json
        bind:
          create_host_path: false
        read_only: true
      # Mount data directory for persistent storage (token.json and other data)
      # The token.json file will be automatically stored in /app/data/token.json
      # and persisted to ./data/token.json on the host
      - type: bind
        source: ./data
        target: /app/data
        bind:
          create_host_path: true
    environment:
      - WEB_AUTH=true

      # API authentication: the container binds 0.0.0.0 internally, so the API
      # requires a token. Pin a stable secret here; if left unset a random token
      # is generated on each start and printed to the container logs.
      # - API_TOKEN=change-me-to-a-long-random-secret

      # Uncomment and set OAUTH_HOST if accessing via custom domain or server IP
      # - OAUTH_HOST=gmail.example.com

      # Uncomment and set OAUTH_EXTERNAL_PORT if using custom port mapping
      # (e.g., if you map ports like "18767:8767", set OAUTH_EXTERNAL_PORT=18767)
      # - OAUTH_EXTERNAL_PORT=18767
    restart: unless-stopped