name: pilotvault-aio

# Production all-in-one — pulls the prebuilt image from the registry instead of
# building. One container runs PocketBase + API Server + Web App. Everything an
# operator needs to set lives in .env.
#
#   1. cp .env.prod.example .env   (then edit it)
#   2. docker compose -f docker-compose.prod.yml pull
#   3. docker compose -f docker-compose.prod.yml up -d
#
# On first boot the bundled PocketBase upserts its superuser from
# POCKETBASE_ADMIN_* and runs the JS migrations, which create/reconcile every
# collection and seed the baseline org + accounts (incl. superadmin@pilotvault.local).
# Idempotent, so restarts and upgrades are safe.

services:
  pilotvault:
    image: "${AIO_IMAGE:-10.2.1.10:5500/admin/pilotvault-aio:latest}"
    container_name: pilotvault-aio
    restart: unless-stopped
    environment:
      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL:?set POCKETBASE_ADMIN_EMAIL in .env}"
      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD:?set POCKETBASE_ADMIN_PASSWORD in .env}"
      CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
    ports:
      - "${WEB_PORT:-8090}:8090"   # Web App (control panel)
      - "${API_PORT:-8080}:8080"   # API Server + embedded API web panel (root /)
      - "${PB_PORT:-8070}:8070"    # PocketBase admin UI / API
    volumes:
      # Named volume by default; set PB_DATA to a host path in .env for a bind mount.
      - "${PB_DATA:-pb_data}:/pb/pb_data"

volumes:
  pb_data: