# Dev-only overlay. NOT loaded automatically (unlike docker-compose.override.yml).
# Opt in explicitly for local development when you need host access to Postgres:
#   docker compose -f docker-compose.yml -f docker-compose.dev.yml up
# Never use this overlay in production — it publishes the database port on the host.
services:
  db:
    ports:
      - "5432:5432"
  app:
    # Relax the production secret guard for local dev — the dev sentinel JWT_SECRET
    # is tolerated (warned) rather than rejected.
    environment:
      APP_ENV: development
      # `.env` sets DATABASE_URL to @localhost for the run-backend-natively workflow
      # (the db port is published above for that). When the app runs IN a container,
      # localhost is the app itself — point it at the `db` service instead. Creds are
      # interpolated from .env so nothing is hardcoded.
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
      # `.env` sets MEDIA_PATH to a HOST path (/home/fabi/EventSnap/media) for the
      # run-backend-natively workflow. In a container that path doesn't exist and the
      # app user can't create it from `/`, so every upload 500s with EACCES. The media
      # volume is mounted at /media (see docker-compose.yml) — point the app there.
      MEDIA_PATH: /media
      # Set here purely so local dev needs no `.env` at all. The `$` are doubled because
      # THIS is a `docker-compose.yml` `environment:` value, where Compose does interpolate.
      #
      # DO NOT COPY THE DOUBLING INTO `.env`. An earlier version of this comment claimed
      # production had "the same bug" and told you to escape the hash as `$$` there — that is
      # wrong and it breaks a working deployment. Compose uses SINGLE-QUOTED `env_file` values
      # literally, which is the form `.env.example` ships, so the `$` segments survive intact;
      # doubling them produces a 74-character string that `looks_bcrypt` rejects and the app
      # refuses to boot on. Verified with `docker compose exec app printenv`.
      ADMIN_PASSWORD_HASH: "$$2b$$12$$PAteqCNpsbm6d0HTJcywfOaUovjAU.iNVlsL7EDYaRC/z4P/xv7ye"
      # Smoke-testing the comment kill-switch: boot-time flag, so it needs a restart
      # (not an admin-UI toggle). Backend rejects new comments (403) and the frontend
      # hides the whole comment UI. Flip back to true (or drop this line) to restore.
      COMMENTS_ENABLED: "false"

  caddy:
    # The caddy service has no env_file, so the Caddyfile's `{$DOMAIN}` would expand to empty
    # and the site block would collapse into a malformed global block. Supply it for local dev
    # (from .env → localhost, which Caddy serves with a local self-signed cert). Production
    # already wires DOMAIN into caddy's `environment:`, guarded with `:?` so an unset value
    # fails the command instead of silently producing a site with no address.
    environment:
      DOMAIN: ${DOMAIN}