services:
  alarm-service:
    extra_hosts:
      - "host.docker.internal:host-gateway"
    # Deliberately no build: block — compose-from-git pulls this image
    # (Calendar still carries one; do not copy it here). A prod compose that
    # can build invites a silent local build when the registry pull fails.
    image: 192.168.122.183:3000/dcntrlized/alarm:dev
    container_name: alarm
    networks:
      - dcntrlized_net
    expose:
      # Single port: the API (/_manifest, /auth/*, /action/*) and the
      # /ws/alarm WebSocket all share :8080. Expose-only so the operator's TLS
      # proxy (NPM-private) can front it on alarm.dcntrlized.org without a
      # host port.
      - "8080"
    ports:
      # Frozen v1 contract: host 8088 -> container 8080.
      - "8088:8080"
    environment:
      - DATABASE_URL=postgres://postgres:dcntrlized@dcntrlized-db:5432/dcntrlized?sslmode=disable
      - AUTH_SERVICE_URL=http://dcntrlized-auth:8080
      # Service identity (same value Maestro injects for the /config ES256
      # token audience in Calendar/KeepNote). Alarm mounts no /config edge in
      # v1, so this is inert today and correct if one is added later.
      - DCNTRLIZED_SERVICE_NAME=alarm
    depends_on:
      - migrate
  migrate:
    image: postgres:16-alpine
    container_name: alarm-migrate
    labels:
      org.dcntrlized.oneoff: "true"
    networks:
      - dcntrlized_net
    volumes:
      - ./database/migrations:/migrations:ro
    environment:
      - PGHOST=dcntrlized-db
      - PGPORT=5432
      - PGUSER=postgres
      - PGPASSWORD=
      - PGDATABASE=dcntrlized
    command: >
      sh -c 'until pg_isready -h dcntrlized-db; do sleep 2; done;
      for f in /migrations/*.sql; do [ -f "$$f" ] || continue; echo "Applying $$f"; psql -v ON_ERROR_STOP=1 -f "$$f" || exit 1; done'

networks:
  dcntrlized_net:
    external: true