# Server: scripts/install.sh sets everything up, or manually:
#   docker compose up -d --build
# The root .env only holds compose variables (LAN_IP); app settings live in backend/.env.
#
# The service is reachable from the home network only: ports are bound to the server's
# LAN IP, not to Tailscale/other interfaces and not to the internet.
services:
  backend:
    image: ${RADARWAKE_IMAGE:-ghcr.io/akosuminoe/radarwake:latest}
    build:
      context: .
      dockerfile: backend/Dockerfile
    container_name: radarwake-backend
    restart: unless-stopped
    env_file: ./backend/.env
    environment:
      DATABASE_URL: sqlite:////app/data/presence.db
    ports:
      - "${LAN_IP:?set LAN_IP in the root .env}:8000:8000"   # dashboard (phone/browser)
      - "${LAN_IP}:8001:8001"                                # ESP32 + pc-agent
    volumes:
      - radarwake-data:/app/data
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

volumes:
  radarwake-data: