# Docker Compose — SyncGames MinIO

Deploys the Path 3 SSOT store on your NAS. Keep using your existing NGINX + Cloudflare Tunnel in front.

## Quick start

```bash
cd SyncGames/deploy/docker   # or /volume1/docker/minio on Synology
cp .env.example .env
# edit .env — passwords, MINIO_SERVER_URL, APP_* keys
# IMPORTANT: save as UTF-8, Unix (LF) line endings, no BOM

docker compose up -d
docker compose --profile init run --rm createbuckets
```

### Synology / `.env` encoding errors (`\x00` in variable name)

Docker Compose only accepts **UTF-8** `.env` files. Editing in Windows Notepad, WordPad, or some Synology File Station flows saves **UTF-16**, which shows up as:

`unexpected character "\x00" in variable name`

**Fix on the NAS** (SSH):

```bash
cd /volume1/docker/minio
# inspect (lots of 00 = UTF-16)
od -An -tx1 .env | head

# recreate clean UTF-8 (overwrite after backing up your secrets)
mv .env .env.bak.utf16 2>/dev/null || true
cat > .env <<'EOF'
MINIO_ROOT_USER=syncgamesadmin
MINIO_ROOT_PASSWORD=change-me-root-password-32chars
MINIO_SERVER_URL=https://syncgames-s3.example.com
SYNCGAMES_BUCKET=syncgames
APP_ACCESS_KEY=syncgamesagent
APP_SECRET_KEY=change-me-agent-secret-32chars
EOF

# or convert if the text is still readable:
# iconv -f UTF-16 -t UTF-8 .env.bak.utf16 | tr -d '\r' > .env

file .env   # should say: UTF-8 text  (or ASCII)
docker compose up -d
```

Prefer editing `.env` over SSH (`nano`/`vi`) or an editor set to **UTF-8 / LF**. Avoid Notepad’s default Unicode save.

MinIO listens on **127.0.0.1:9000** (API) and **127.0.0.1:9001** (console).

## Wire to existing NGINX

Copy or include [`nginx-syncgames-s3.conf`](nginx-syncgames-s3.conf), set `server_name` to your Cloudflare hostname, reload NGINX.

Point Cloudflare Tunnel at that NGINX vhost (same pattern as your other services).

## Agent config

```toml
endpoint_url = "https://syncgames-s3.example.com"
bucket = "syncgames"
region = "us-east-1"
path_style = true
access_key = "<APP_ACCESS_KEY from .env>"
secret_key = "<APP_SECRET_KEY from .env>"
```

Then run `syncgames doctor` (or Doctor in the AppImage GUI).

## Optional tunnel profile

Only if you do **not** already terminate tunnels on the NAS:

```bash
# set CLOUDFLARE_TUNNEL_TOKEN in .env
docker compose --profile tunnel up -d
```

Configure the tunnel hostname to `http://127.0.0.1:80` (NGINX) ideally, or `http://127.0.0.1:9000` for direct MinIO (skips NGINX hardening — not preferred).

## Data

Volume: `syncgames_minio_data`. Console: http://127.0.0.1:9001 (or NAS LAN IP if you publish the port) with **root** user/password from `.env`.

### Console “unable to login due to network error”

MinIO Console runs in your **browser**. Login XHRs must reach the **API URL**, which must be a host your PC can open.

Your logs were advertising `API: https://syncgames-s3.example.com` / `https://min.hisora.dev` — the browser cannot complete Console login against those from `:9001`.

**Working LAN setup**

1. Copy updated `docker-compose.yml` to the NAS.
2. In `.env` set (use your real NAS IP):

```bash
MINIO_SERVER_URL=http://192.168.1.50:9000
MINIO_BROWSER_REDIRECT_URL=http://192.168.1.50:9001
```

3. Recreate:

```bash
docker compose up -d --force-recreate minio
docker compose logs minio | head -40
```

4. Confirm logs show `API: http://192.168.1.50:9000` — **not** `example.com` or `min.hisora.dev`.
5. Open **exactly** `http://192.168.1.50:9001` (same IP).
6. Login as `MINIO_ROOT_USER` (exact spelling).

Cloudflare/`https://min.hisora.dev` is for SyncGames agents in `agent.toml` only — not for Console env vars.