services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: moonbase
      POSTGRES_USER: moonbase
      POSTGRES_PASSWORD: moonbase
    volumes:
      - /mnt/user/appdata/moonbase/postgres:/var/lib/postgresql/data
    networks:
      - internal

  app:
    build: .
    image: moonbase:latest
    restart: unless-stopped
    depends_on:
      - postgres
    ports:
      - "8053:3000"
    environment:
      DATABASE_URL: postgresql://moonbase:moonbase@postgres:5432/moonbase
      # Secrets are interpolated from a gitignored .env next to this file on the
      # host (never committed — see CLAUDE.md). docker compose auto-loads ./.env.
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
      NEXTAUTH_URL: http://192.168.0.5:8053
      # Suggestions module — files feedback as Gitea issues on bonna61/Moonbase.
      GITEA_URL: http://192.168.0.5:3022
      GITEA_TOKEN: ${GITEA_TOKEN}
      GITEA_REPO: bonna61/Moonbase
      # Self-update — admin "Pull & rebuild" signals the updater sidecar.
      UPDATER_URL: http://updater:9000/hooks/moonbase-update
      UPDATER_SECRET: ${UPDATER_SECRET}
    volumes:
      # Persist suggestion screenshot uploads across rebuilds.
      - /mnt/user/appdata/moonbase/uploads:/app/public/uploads
    networks:
      - internal

  # Privileged self-update sidecar: holds the docker socket and rebuilds `app`
  # on an authenticated webhook trigger. Only runs the fixed updater/update.sh.
  updater:
    build:
      context: .
      dockerfile: Dockerfile.updater
    image: moonbase-updater:latest
    restart: unless-stopped
    command:
      - -hooks
      - /appdata/updater/hooks.json
      - -template
      - -hotreload
      - -ip
      - 0.0.0.0
      - -port
      - "9000"
      - -verbose
    environment:
      UPDATER_SECRET: ${UPDATER_SECRET}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /mnt/user/appdata/moonbase:/appdata
    networks:
      - internal

networks:
  internal:
    driver: bridge