name: pilotvault

# Production PilotVault stack — pulls prebuilt images from the registry instead of
# building from source. Everything an operator needs to set lives in .env.
#
#   1. cp .env.prod.example .env   (then edit — secrets/ports/volumes/images)
#   2. docker compose -f docker-compose.prod.yml pull
#   3. docker compose -f docker-compose.prod.yml up -d
#
# Traffic flow (browser): Web App BFF --/api--> API Server --> PocketBase.
#
# On first boot PocketBase upserts its superuser from POCKETBASE_ADMIN_* and runs
# the bundled migrations (create/reconcile collections + seed the baseline org and
# the superadmin@pilotvault.local login). Idempotent, so restarts/upgrades are safe.

services:
  pocketbase:
    image: "${PB_IMAGE:-10.2.1.10:5500/admin/pilotvault-pocketbase:latest}"
    container_name: pilotvault-pocketbase
    restart: unless-stopped
    environment:
      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL:?set POCKETBASE_ADMIN_EMAIL in .env}"
      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD:?set POCKETBASE_ADMIN_PASSWORD in .env}"
    volumes:
      # Named volume by default; set PB_DATA to a host path in .env for a bind mount.
      - "${PB_DATA:-pb_data}:/pb/pb_data"
    ports:
      # Bound to localhost by default — the admin UI (/_/) is reachable only on the
      # host. Set PB_BIND=0.0.0.0 in .env to expose it on the network.
      - "${PB_BIND:-127.0.0.1}:${PB_PORT:-8070}:8070"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 12
      start_period: 10s

  api-server:
    image: "${API_IMAGE:-10.2.1.10:5500/admin/pilotvault-api-server:latest}"
    container_name: pilotvault-api-server
    restart: unless-stopped
    depends_on:
      pocketbase:
        condition: service_healthy
    environment:
      API_ADDR: ":8080"
      POCKETBASE_URL: "http://pocketbase:8070"
      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
      CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
    ports:
      # Localhost-only by default (the Web App reaches it over the internal
      # network). Set API_BIND=0.0.0.0 to expose the API panel on the network.
      - "${API_BIND:-127.0.0.1}:${API_PORT:-8080}:8080"

  web-app:
    image: "${WEB_IMAGE:-10.2.1.10:5500/admin/pilotvault-web-app:latest}"
    container_name: pilotvault-web-app
    restart: unless-stopped
    depends_on:
      - api-server
    environment:
      ADDR: ":8090"
      API_BASE: "http://api-server:8080"
    ports:
      # The public front door. Bound on all interfaces so browsers can reach it.
      - "${WEB_PORT:-8090}:8090"

volumes:
  pb_data: