services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: ${POSTGRES_DB:-scoreboardtools}
    volumes:
      - db-data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U postgres']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  server:
    build: .
    environment:
      DATABASE_URL: postgres://postgres:${POSTGRES_PASSWORD:-postgres}@db:5432/${POSTGRES_DB:-scoreboardtools}
      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env}
      COOKIE_SECURE: ${COOKIE_SECURE:-true}
      UPLOAD_DIR: /data/uploads
      PORT: '3000'
    volumes:
      - uploads:/data/uploads
    depends_on:
      db:
        condition: service_healthy
    # Bind to localhost only — kept for local debugging on the host. The reverse proxy
    # (Nginx Proxy Manager) reaches this over the shared `proxy` network by container name,
    # so no public host port is needed.
    ports:
      - '127.0.0.1:3000:3000'
    networks:
      - default
      - proxy
    restart: unless-stopped

volumes:
  db-data:
  uploads:

networks:
  # NPM lives on this network (its compose project's default network). Joining it lets
  # NPM proxy to `scoreboardtools-server-1:3000` directly. External = managed elsewhere.
  proxy:
    external: true
    name: plex_default