docker-compose.yml

services:
  server:
    build:
      context: .
      dockerfile: packages/server/Dockerfile
      args:
        # Build-time CA certificate — base64-encoded PEM bundle (see env.example).
        # Pass via: docker compose --env-file .docker-certs.env build
        EXTRA_CA_CERTS_B64: ${EXTRA_CA_CERTS_B64:-}
    # Not exposed publicly — nginx is the only ingress point.
    # Uncomment the line below to expose the server port for local debugging:
    # ports:
    #   - "8080:8080"
    # env_file passes values from .env literally into the container — no $ interpolation.
    # This means APP_PASSWORD, SESSION_SECRET, tokens, etc. can contain any special
    # characters without escaping. Values in environment: below take precedence.
    env_file:
      - path: .env
        required: false
    environment:
      PORT: 8080
      NODE_ENV: production
      # Trust X-Forwarded-For from nginx for accurate rate-limit key resolution
      TRUST_PROXY: "true"
      # Defaults for optional vars — overridden by .env values via env_file above
      FRONTEND_URL: ${FRONTEND_URL:-http://localhost:5174}
      CACHE_MAX_SIZE_MB: ${CACHE_MAX_SIZE_MB:-128}
      COOKIE_SECURE: ${COOKIE_SECURE:-false}
      LOG_LEVEL: ${LOG_LEVEL:-info}
    healthcheck:
      # Uses Node's built-in fetch — no curl dependency in the minimal runtime image.
      test: ["CMD", "node", "-e", "fetch('http://localhost:8080/system/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    # Docker applies exponential backoff between restarts (up to ~100s),
    # so rapid crash loops are throttled automatically.
    restart: unless-stopped

  web:
    build:
      context: .
      dockerfile: packages/web/Dockerfile
      args:
        EXTRA_CA_CERTS_B64: ${EXTRA_CA_CERTS_B64:-}
    ports:
      - "${WEB_PORT:-5174}:80"
    depends_on:
      server:
        condition: service_healthy
    restart: unless-stopped