services:
  db:
    image: postgres:18-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${DB_NAME}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - db-data:/var/lib/postgresql
      - ./assets/db/databaseSchema.sql:/docker-entrypoint-initdb.d/01-schema.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
      interval: 5s
      timeout: 5s
      retries: 10

  app:
    image: ghcr.io/albertamat/vaultisse:${APP_TAG:-latest}
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    env_file: .env
    environment:
      # The app always talks to the "db" service on the compose network,
      # regardless of what DB_HOST/DB_PORT are set to in .env.
      DB_HOST: db
      DB_PORT: 5432
    ports:
      - "${API_PORT:-3000}:${API_PORT:-3000}"
    volumes:
      - app-logs:/app/logs

  # Optional: exposes the app to the internet via Cloudflare Tunnel instead
  # of (or in addition to) the published port above — no inbound port or
  # cert needed. Only starts if you opt in with the "cloudflare" profile:
  #   docker compose --profile cloudflare up -d
  # Requires CLOUDFLARE_TUNNEL_TOKEN in .env. If you'd rather run your own
  # reverse proxy/DNS, just never pass that profile and this is skipped.
  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    profiles: ["cloudflare"]
    command: tunnel run --token ${CLOUDFLARE_TUNNEL_TOKEN}
    depends_on:
      - app

volumes:
  db-data:
  app-logs: