name: pilotvault

# Combined PilotVault stack: PocketBase (database) + API Server + Web App, built
# from source on a shared network. Run from this Docker/ folder:
#
#   cp .env.example .env   # then edit the secrets/ports
#   docker compose up --build
#
# Traffic flow (browser): Web App BFF --/api--> API Server --> PocketBase.
#
# On first boot PocketBase upserts its superuser from POCKETBASE_ADMIN_* and runs
# the bundled JS migrations, which create/reconcile every collection and seed the
# baseline org + accounts (including the superadmin@pilotvault.local app login).
# Every step is idempotent, so restarts and upgrades are safe.

services:
  pocketbase:
    build:
      # Repo root — the Dockerfile bundles the migrations from "API Server/".
      context: ..
      dockerfile: Docker/pocketbase/Dockerfile
    image: pilotvault-pocketbase
    container_name: pilotvault-pocketbase
    restart: unless-stopped
    environment:
      # The superuser is created/updated on boot (the API Server authenticates
      # with it). This is the only place the first superuser can be created — the
      # REST API cannot bootstrap it.
      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL:?set POCKETBASE_ADMIN_EMAIL in .env}"
      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD:?set POCKETBASE_ADMIN_PASSWORD in .env}"
    volumes:
      # Named volume by default; set PB_DATA to a host path in .env for a bind mount.
      - "${PB_DATA:-pb_data}:/pb/pb_data"
    ports:
      # Admin UI / API exposed on the host for management (http://host:8070/_/).
      - "${PB_PORT:-8070}:8070"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8070/api/health || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 12
      start_period: 10s
    networks:
      - pilotvault

  api-server:
    build:
      context: "../API Server"
    image: pilotvault-api-server
    container_name: pilotvault-api-server
    restart: unless-stopped
    depends_on:
      pocketbase:
        condition: service_healthy
    environment:
      API_ADDR: ":8080"
      # Reach PocketBase by its service name on the shared network.
      POCKETBASE_URL: "http://pocketbase:8070"
      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
      # Same-origin requests go through the Web App BFF, so CORS is only needed if
      # a browser ever calls the API Server directly. Default to the web origin.
      CORS_ALLOW_ORIGINS: "${CORS_ALLOW_ORIGINS:-http://localhost:8090}"
    ports:
      # Optional direct access to the API Server (and its panel at /); the Web App
      # reaches it over the internal network, not this host port.
      - "${API_PORT:-8080}:8080"
    networks:
      - pilotvault

  web-app:
    build:
      context: "../Web App"
    image: pilotvault-web-app
    container_name: pilotvault-web-app
    restart: unless-stopped
    depends_on:
      - api-server
    environment:
      ADDR: ":8090"
      # The BFF reverse-proxies /api/* to the API Server over the shared network.
      API_BASE: "http://api-server:8080"
    ports:
      - "${WEB_PORT:-8090}:8090"
    networks:
      - pilotvault

networks:
  pilotvault:
    driver: bridge

volumes:
  pb_data: