# Volleyboard — one Python process (FastAPI serving API + built SPA) + a
# Postgres 17 sidecar on the project-internal network only (no host port on db,
# unreachable from LAN/VPN). Deploy: srv-gw deploy --project volleyboard --build
#
# NOTE: no `network_mode: bridge` — it is mutually exclusive with a multi-service
# setup. Dropping it puts both services on compose's implicit default network,
# where the app reaches the db by the service name `db`.

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    image: ${PROJECT_NAME}-app
    container_name: ${PROJECT_NAME}-app
    restart: unless-stopped

    env_file:
      - path: .env
        required: true
      # BW_CLIENT_ID / BW_CLIENT_SECRET, written 0600 by `app-client-register`.
      # Optional so pre-registration builds don't fail; real creds land here
      # before the production deploy.
      - path: .bw-auth.env
        required: false
    environment:
      - BW_AUTH=https://auth.bowden.works
      - BW_APP_DOMAIN=https://volleyboard.bowden.works
      - APP_ENV=production

    # DO NOT CHANGE host binding - port managed by gateway.
    # Host 172.17.0.1:${PORT} (Docker bridge only) -> container :8000.
    ports:
      - "172.17.0.1:${PORT}:8000"

    volumes:
      - ./data/uploads:/app/data/uploads

    depends_on:
      db:
        condition: service_healthy

    mem_limit: 1g
    cpus: 1.0

  db:
    image: postgres:17
    container_name: ${PROJECT_NAME}-db
    restart: unless-stopped

    environment:
      POSTGRES_DB: volleyboard
      POSTGRES_USER: volleyboard
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}

    volumes:
      - ./data/pg:/var/lib/postgresql/data

    # No `ports:` — project-internal only.
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U volleyboard -d volleyboard"]
      interval: 5s
      timeout: 3s
      retries: 10

    mem_limit: 512m
    cpus: 0.5
