services:
  keepnote-service:
    extra_hosts:
      - "host.docker.internal:host-gateway"
    image: 192.168.122.183:3000/dcntrlized/keepnote:dev
    container_name: keepnote
    networks:
      - dcntrlized_net
    ports:
      - "8081:8080"
      - "9090:90"
    # Contract rev 9 §3.4: ONE plaintext listener, published as 8081:8080. The
    # browser web app (SPA + /web/*) rides the same port — there is no separate
    # browser port. Opt-in in prod via DCNTRLIZED_WEB_ENABLED=true;
    # web.Validate() then fails closed unless DCNTRLIZED_WEB_ORIGINS is
    # non-empty and COOKIE_SECURE=true.
    environment:
      - DATABASE_URL=postgres://postgres:dcntrlized@dcntrlized-db:5432/dcntrlized?sslmode=disable
      - AUTH_SERVICE_URL=http://dcntrlized-auth:8080
      - DCNTRLIZED_WEB_ENABLED=${DCNTRLIZED_WEB_ENABLED:-false}
      - DCNTRLIZED_WEB_ORIGINS=${DCNTRLIZED_WEB_ORIGINS:-}
      - COOKIE_SECURE=${COOKIE_SECURE:-true}
    depends_on:
      - migrate
    build:
      context: .
      dockerfile: Dockerfile

  migrate:
    image: postgres:16-alpine
    container_name: keepnote-migrate
    labels:
      org.dcntrlized.oneoff: "true"
    networks:
      - dcntrlized_net
    volumes:
      - ./database/migrations:/migrations:ro
    environment:
      - PGHOST=dcntrlized-db
      - PGPORT=5432
      - PGUSER=postgres
      - PGPASSWORD=dcntrlized
      - PGDATABASE=dcntrlized
    command: >
      sh -c 'until pg_isready -h dcntrlized-db; do sleep 2; done;
      for f in /migrations/*.sql; do [ -f "$$f" ] || continue; echo "Applying $$f"; psql -v ON_ERROR_STOP=1 -f "$$f" || exit 1; done'

networks:
  dcntrlized_net:
    external: true