services:
  warmbox:
    build: .
    image: warmbox:local
    restart: unless-stopped
    env_file: .env
    environment:
      DATABASE_URL: file:/data/warmbox.db
      NODE_ENV: production
    volumes:
      - warmbox-data:/data
    ports:
      # Bind to localhost only when using the Caddy profile (recommended).
      # For LAN testing without Caddy, change to "3000:3000".
      - "127.0.0.1:3000:3000"
    healthcheck:
      test: ['CMD', 'node', '-e', "fetch('http://127.0.0.1:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 40s

  # Optional HTTPS reverse proxy — requires a public DNS name pointing at this host.
  # Start with: docker compose --profile caddy up -d
  caddy:
    profiles: [caddy]
    image: caddy:2-alpine
    restart: unless-stopped
    depends_on:
      warmbox:
        condition: service_healthy
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - ./deploy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config

  # Optional Cloudflare Tunnel — HTTPS without opening router ports (great for home servers).
  # 1. Create a tunnel in Cloudflare Zero Trust → copy token
  # 2. Set CLOUDFLARE_TUNNEL_TOKEN in .env
  # 3. docker compose --profile cloudflare up -d
  cloudflared:
    profiles: [cloudflare]
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    depends_on:
      warmbox:
        condition: service_healthy
    command: tunnel run
    environment:
      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN}

volumes:
  warmbox-data:
  caddy-data:
  caddy-config: