#version: '3.8'

services:
  digiserver-app:
    build: .
    container_name: digiserver-v2
    # Don't expose directly; use Caddy reverse proxy instead
    # Port 5000 is also mapped directly for dev/testing access when Caddy isn't running
    expose:
      - "5000"
    ports:
      - "5000:5000"
    volumes:
      # Code is in the Docker image - no volume mount needed
      # Only mount persistent data folders:
      - ./data/instance:/app/instance
      - ./data/uploads:/app/app/static/uploads
    environment:
      - FLASK_ENV=production
      - SECRET_KEY=${SECRET_KEY:-your-secret-key-change-this}
      - ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-admin123}
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:5000/').read()"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - digiserver-network

  # Caddy reverse proxy — auto-provisions Let's Encrypt certs when a real domain is configured
  caddy:
    image: caddy:2-alpine
    container_name: digiserver-caddy
    ports:
      - "8080:80"
      - "8443:443"
    volumes:
      - ./data/Caddyfile:/etc/caddy/Caddyfile:rw
      - ./data/caddy-data:/data
      - ./data/caddy-config:/config
      - ./data/caddy-logs:/var/log/caddy
    depends_on:
      digiserver-app:
        condition: service_started
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:80/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    networks:
      - digiserver-network

networks:
  digiserver-network:
    driver: bridge