# Compose v2 — `version:` key intentionally omitted (deprecated).
#
# Topology: a bundled Postgres (`db`, database `forge`) + the FORGE app. The
# schema self-bootstraps in initDB() on app boot (no ORM, no migrations) and
# seeds the bundled ticket archives on first run. App host port is 3099 (FORGE's
# lane); behind the Synology reverse proxy this is what forge.mycloud.dp.ua maps to.

name: forge

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: forge
      POSTGRES_USER: forge
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-forge}
    volumes:
      - forge-db:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U forge -d forge']
      interval: 10s
      timeout: 5s
      retries: 5

  app:
    build:
      context: .
      target: runtime
    image: forge-app:latest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    ports:
      # Host 3089 -> container 3000. 3089 is FORGE's lane.
      - '3089:3000'
    environment:
      DATABASE_URL: postgresql://forge:${POSTGRES_PASSWORD:-forge}@db:5432/forge
      NODE_ENV: production
      PORT: 3000
      # Read-API auth (see .env / .env.example).
      SESSION_SECRET: ${SESSION_SECRET:?set SESSION_SECRET in .env}
      AUTH_USER: ${AUTH_USER:-admin}
      AUTH_PASS: ${AUTH_PASS:?set AUTH_PASS in .env}
      # Guards POST /api/tokens. Prefer minting via the CLI instead (see SETUP.md).
      ADMIN_KEY: ${ADMIN_KEY:-}
    healthcheck:
      test: ['CMD', 'wget', '-qO-', 'http://localhost:3000/healthz']
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3
    mem_limit: 1g
    logging:
      driver: json-file
      options:
        max-size: '10m'
        max-file: '3'

volumes:
  forge-db: