Mail access: IMAP + app password (IPv4 only), not Gmail API

docker-compose.yml

@@ -0,0 +1,52 @@
+name: email-agent
+
+# Own container and image for this project (AGENTS.md §9). Not shared with any
+# other project.
+
+services:
+  email-agent:
+    build:
+      context: .
+      args:
+        VERSION: ${EMAIL_AGENT_VERSION:-dev}
+        COMMIT: ${EMAIL_AGENT_COMMIT:-unknown}
+        BUILD_TIME: ${EMAIL_AGENT_BUILD_TIME:-}
+    image: email-agent:${EMAIL_AGENT_TAG:-latest}
+    container_name: email-agent
+    restart: unless-stopped
+
+    # Posture: keep the service on the internal network only. Caddy on .35
+    # proxies to this port. Publishing is required for that hop.
+    ports:
+      - "${EMAIL_AGENT_PORT:-8790}:8790"
+
+    environment:
+      EMAIL_AGENT_ENV: ${EMAIL_AGENT_ENV:-production}
+      EMAIL_AGENT_ADDR: ":8790"
+      EMAIL_AGENT_DB_PATH: /data/email_agent.db
+      EMAIL_AGENT_LOG_LEVEL: ${EMAIL_AGENT_LOG_LEVEL:-info}
+      EMAIL_AGENT_PUBLIC_BASE_URL: ${EMAIL_AGENT_PUBLIC_BASE_URL:-https://mail.lab.audasmedia.com.au}
+      # Secrets: names only here. Values are supplied by the host environment
+      # (see ~/.config/environment.d/10-secrets.conf) or a gitignored .env file,
+      # and are never committed.
+      EMAIL_AGENT_SESSION_SECRET: ${EMAIL_AGENT_SESSION_SECRET:-}
+      JEV_BASE_URL: ${JEV_BASE_URL:-}
+      JEV_API_KEY: ${JEV_API_KEY:-}
+      OMNIROUTE_BASE_URL: ${OMNIROUTE_BASE_URL:-}
+      OMNIROUTE_API_KEY: ${OMNIROUTE_API_KEY:-}
+      EMAIL_AGENT_GMAIL_CREDENTIALS_FILE: ${EMAIL_AGENT_GMAIL_CREDENTIALS_FILE:-}
+      EMAIL_AGENT_GMAIL_TOKEN_FILE: ${EMAIL_AGENT_GMAIL_TOKEN_FILE:-}
+      HUB_TOKEN: ${HUB_TOKEN:-}
+
+    volumes:
+      - email_agent_data:/data
+
+    healthcheck:
+      test: ["CMD", "/usr/local/bin/email-agent", "-healthcheck"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+
+volumes:
+  email_agent_data: