# Garden v2 — FastAPI app + PostgreSQL (pgvector) sidecar.
#
# Deploy via:  srv-gw deploy --project garden2 --build
# (never `docker` directly; the gateway owns container lifecycle)
#
# Security posture (per /srv/projects/standards/react.md):
#   - db has NO host port: it lives on the compose-internal network only,
#     unreachable from LAN/VPN/host processes outside this project.
#   - app binds 172.17.0.1 only (Docker bridge) — external access goes
#     through Caddy at garden2.riverway.ca.

services:
  app:
    build: .
    container_name: ${PROJECT_NAME}-app
    restart: unless-stopped
    # .env = app config; .bw-auth.env = BW_CLIENT_ID/SECRET (0600, gateway-
    # owned, written by `srv-gw app-client-register --secret-out`). The app
    # owns auth in PUBLIC mode (BW Auth Pattern B) — no separate gate service.
    env_file:
      - .env
      - .bw-auth.env
    environment:
      DATA_DIR: /data
    # DO NOT CHANGE - port is managed by gateway
    ports:
      - "172.17.0.1:${PORT}:8000"
    volumes:
      - ./data:/data
    depends_on:
      db:
        condition: service_healthy
    mem_limit: 1g
    cpus: 1.0

  db:
    image: pgvector/pgvector:pg17
    container_name: ${PROJECT_NAME}-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: garden
      POSTGRES_USER: garden
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - ./data/pg:/var/lib/postgresql/data
    # NO ports: internal network only.
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U garden -d garden"]
      interval: 5s
      timeout: 3s
      retries: 10
    mem_limit: 512m
    cpus: 0.5
