# KNELSecretsManager Go CLI (ukrrs-secretsmgr-cli) — always-hot container per
# house convention (Charles 2026-08-31): docker exec per invocation, never
# docker run per call. Scoped ops only; NEVER bare compose down.
#
#   docker compose -f /path/to/this up -d smcli
#   docker exec -i ukrrs-secretsmgr-cli smcli env creds/cloudron
#
# Credentials for the vault account come from a 0600 env file (SM_EMAIL,
# SM_PASSWORD, SM_TOTP_SECRET, SM_SERVER) — never committed.
name: knel-secretsmanager
services:
  smcli:
    image: git.knownelement.com/knel/knel-secretsmanager-cli@sha256:8abfc55dfa7ca9e70b286a249b7ca823531bd55da29bed70d3354a58ec4d8fec
    container_name: ukrrs-secretsmgr-cli
    restart: unless-stopped
    entrypoint: ["sleep", "infinity"]
    init: true
    env_file:
      - path: ./smcli.env
        required: false
    environment:
      SM_STATE_DIR: /data/state
    volumes:
      - smcli-state:/data/state
volumes:
  smcli-state: