# For development the database alone is enough:  ./scripts/db.sh up
# Full / production run:                        docker compose up -d --build
#
# SESSION_SECRET must be set in the environment or in a .env file next to this
# one. It is not marked required here because compose resolves every variable in
# the file whatever service you name, and that would break `./scripts/db.sh up`.
# The server refuses to start without it and says so.
services:
  db:
    image: postgres:17-alpine
    container_name: szabadpalya-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-szabadpalya}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-szabadpalya}
      POSTGRES_DB: ${POSTGRES_DB:-szabadpalya}
    # Loopback only. Docker publishes ports by writing DNAT rules that bypass
    # UFW entirely, so a bare "5433:5432" would put Postgres on the public
    # internet no matter what the host firewall says. Development still reaches
    # it on localhost:5433, which is all scripts/db.sh ever wanted.
    ports:
      - "127.0.0.1:5433:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-szabadpalya} -d ${POSTGRES_DB:-szabadpalya}"]
      interval: 5s
      timeout: 3s
      retries: 10

  # Runs once, migrates, exits. The app starts only after it succeeds.
  #
  # Same image as app, same binary, one flag different — so the two can never
  # disagree about what "migrated" means. That used to be a separate Dockerfile
  # stage; a command override says it with less machinery and one less image to
  # ship.
  migrate:
    image: szabadpalya:latest
    command: ["server", "-migrate"]
    build:
      context: .
      target: runner
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-szabadpalya}:${POSTGRES_PASSWORD:-szabadpalya}@db:5432/${POSTGRES_DB:-szabadpalya}
      SESSION_SECRET: ${SESSION_SECRET:-}
    depends_on:
      db:
        condition: service_healthy
    restart: "no"

  # `image:` is what lets scripts/deploy.sh build on a laptop and ship the
  # result: compose uses an image of this name when one is already present and
  # only falls back to `build:` when it is not, or when asked with --build.
  app:
    image: szabadpalya:latest
    build:
      context: .
      target: runner
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER:-szabadpalya}:${POSTGRES_PASSWORD:-szabadpalya}@db:5432/${POSTGRES_DB:-szabadpalya}
      SESSION_SECRET: ${SESSION_SECRET:-}
      BASE_URL: ${BASE_URL:-http://localhost:3000}
      ADMIN_EMAILS: ${ADMIN_EMAILS:-}
    # Loopback only: nginx terminates TLS and proxies to 127.0.0.1:3000.
    # Published on every interface this would also answer on http://<ip>:3000,
    # which is the same site without TLS — and BASE_URL being https there means
    # the session cookie is Secure, so logging in that way silently fails.
    ports:
      - "127.0.0.1:3000:3000"
    depends_on:
      migrate:
        condition: service_completed_successfully
    restart: unless-stopped

# Declared, and named explicitly. Without the name compose would derive one from
# the project directory (szabadpalya_pgdata) while scripts/db.sh's no-compose
# path uses szabadpalya-pgdata — two databases, one of them silently empty,
# depending on whether the compose plugin happens to be installed.
volumes:
  pgdata:
    name: szabadpalya_pgdata