services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    env_file: .env
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10

  app:
    build:
      context: ./backend
      dockerfile: Dockerfile
    restart: unless-stopped
    env_file: .env
    # Force production mode here (not via .env, which is easy to forget) so the
    # backend's JWT-secret guard actually fires on this deployment.
    environment:
      APP_ENV: production
    # Backstop the in-app upload RAM caps: if anything slips the per-request
    # bounds, the container is OOM-killed instead of the 8 GB host.
    mem_limit: 3g
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - media_data:/media
    expose:
      - "3000"
    # /health is unauthenticated; start_period covers the boot-time migrations.
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://localhost:3000/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    restart: unless-stopped
    env_file: .env
    depends_on:
      app:
        condition: service_healthy
    expose:
      - "3001"
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://localhost:3001/"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
    # Gate on readiness so Caddy doesn't proxy to a not-yet-listening upstream
    # (which otherwise shows brief 502s on boot/restart).
    depends_on:
      app:
        condition: service_healthy
      frontend:
        condition: service_healthy

volumes:
  postgres_data:
  media_data:
  caddy_data: