# The one compose file.
#
#     cd deploy && docker compose up
#
# That is the whole quickstart, and it has to work under `env -i` with no .env
# file, no keys and no account — which is what the CI job asserts by curling
# /api/v1/health. Every variable below therefore carries a `:-` default, so an
# empty environment resolves to an empty string, and the config layer reads an
# empty string as "not set" and falls back. Nothing here is required.
#
# They are listed anyway because being able to run
#
#     TERA_WEATHER_SOURCE=nws TERA_WEATHER_CONTACT=you@example.com docker compose up
#
# without editing a file is most of what makes this a dev kit. The full list of
# knobs is in ../server/README.md.

name: tera

services:
  api:
    build:
      context: ..
      dockerfile: server/Dockerfile
    # Loopback only. This is meant to sit behind Caddy on the same box; see
    # Caddyfile.snippet. Change the left-hand side, not the right.
    ports:
      - "127.0.0.1:8431:8431"
    environment:
      TERA_HOST: "0.0.0.0"
      TERA_LOG_LEVEL: "${TERA_LOG_LEVEL:-info}"
      TERA_ORIGIN_LAT: "${TERA_ORIGIN_LAT:-}"
      TERA_ORIGIN_LNG: "${TERA_ORIGIN_LNG:-}"
      TERA_WEATHER_SOURCE: "${TERA_WEATHER_SOURCE:-}"
      TERA_WEATHER_CONTACT: "${TERA_WEATHER_CONTACT:-}"
      TERA_FLIGHTS_SOURCE: "${TERA_FLIGHTS_SOURCE:-}"
      TERA_MARKERS_SOURCE: "${TERA_MARKERS_SOURCE:-}"
      TERA_MARKERS_FILE: "${TERA_MARKERS_FILE:-}"
      TERA_OFFICES_DIR: "${TERA_OFFICES_DIR:-}"
      TERA_AUTH_MODE: "${TERA_AUTH_MODE:-}"
      TERA_AUTH_ENTRY_URL: "${TERA_AUTH_ENTRY_URL:-}"
      TERA_AUTH_REVALIDATE_URL: "${TERA_AUTH_REVALIDATE_URL:-}"
      TERA_AUTH_JWT_SECRET: "${TERA_AUTH_JWT_SECRET:-}"
    # Offices and marker snapshots are files. Mount them read-only where you
    # keep them; the container writes nothing, ever.
    #
    # volumes:
    #   - ../public/offices:/data/offices:ro
    healthcheck:
      # No curl in the image and none wanted. Node is already here.
      test:
        - CMD
        - node
        - -e
        - "fetch('http://127.0.0.1:8431/api/v1/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 5s
    restart: unless-stopped
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true