# Pull-only MDMesh stack — no build context, every service runs a published GHCR image. This is the
# "no clone, no build" deploy. Easiest via quickstart.sh, or by hand:
#
#   curl -fsSLO https://raw.githubusercontent.com/MDMesh-app/MDMesh/main/docker-compose.release.yml
#   # write a .env (DB_PASSWORD, HASH_SECRET, BASE_URL, IMAGE_OWNER, …) — see quickstart.sh. For the tunnel, include
#   # COMPOSE_PROFILES=cloudflare: --profile alone doesn't reach caddy, which then won't believe cloudflared's
#   # CF-Connecting-IP (docker/edge-peers.sh)
#   docker compose -f docker-compose.release.yml --profile cloudflare up -d                 # tunnel
#   docker compose -f docker-compose.release.yml -f docker-compose.domain.yml up -d         # own domain
#
# Pin SERVER_VERSION/WEB_VERSION/SUPERVISOR_VERSION in .env for production; they default to :latest. The quick start
# and every update pin them by digest from the signed release manifest (0.5.0@sha256:…: docker pulls by the digest).
services:
  postgres:
    image: postgres:14
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${DB_NAME:-mdmesh}
      POSTGRES_USER: ${DB_USER:-mdmesh}
      POSTGRES_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env}
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-mdmesh} -d ${DB_NAME:-mdmesh}"]
      interval: 5s
      timeout: 5s
      retries: 20

  server:
    image: ghcr.io/${IMAGE_OWNER:-mdmesh-app}/mdmesh-server:${SERVER_VERSION:-latest}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DB_HOST: postgres
      DB_PORT: "5432"
      DB_NAME: ${DB_NAME:-mdmesh}
      DB_USER: ${DB_USER:-mdmesh}
      DB_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env}
      BASE_URL: ${BASE_URL:?set BASE_URL in .env}
      HASH_SECRET: ${HASH_SECRET:?set HASH_SECRET in .env}
      # Optional; unset = the key the server keeps in its volume. Prefixed .env key for the reason given at JAVA_OPTS.
      JWT_SECRET: ${SERVER_JWT_SECRET:-}
      SECURE_ENROLLMENT: ${SECURE_ENROLLMENT:-0}
      LEGACY_DEVICE_API: ${LEGACY_DEVICE_API:-0}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-25}
      SMTP_FROM: ${SMTP_FROM:-mdm@localhost}
      SMTP_USERNAME: ${SMTP_USERNAME:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_SSL: ${SMTP_SSL:-false}
      SMTP_STARTTLS: ${SMTP_STARTTLS:-false}
      # Optional JVM flags, e.g. a temporary DEBUG log config (docs/OPERATIONS.md "Server logs"). Read from the
      # prefixed .env key: compose lets the shell override .env, and a generic JAVA_OPTS exported on a Java host must
      # not reach the server.
      JAVA_OPTS: ${SERVER_JAVA_OPTS:-}
    volumes:
      - mdmeshdata:/opt/mdmesh

  caddy:
    image: ghcr.io/${IMAGE_OWNER:-mdmesh-app}/mdmesh-web:${WEB_VERSION:-latest}
    restart: unless-stopped
    depends_on:
      - server
      - supervisor
    environment:
      SITE_ADDRESS: ${SITE_ADDRESS:-:80}
      ACME_EMAIL: ${ACME_EMAIL:-}
      # The hosting mode: in tunnel mode (cloudflare) the edge believes cloudflared's CF-Connecting-IP
      # (docker/edge-peers.sh).
      COMPOSE_PROFILES: ${COMPOSE_PROFILES:-}
      # Proxies in front of the edge (a CDN, a load balancer) whose X-Forwarded-For it believes, as space-separated
      # CIDRs; set in .env. Unset or empty: none (docs/OPERATIONS.md, Sign-in limits).
      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-}
    volumes:
      - caddy_data:/data
      - caddy_config:/config

  supervisor:
    image: ghcr.io/${IMAGE_OWNER:-mdmesh-app}/mdmesh-supervisor:${SUPERVISOR_VERSION:-latest}
    restart: unless-stopped
    environment:
      GITHUB_REPO: ${GITHUB_REPO:-}
      UPDATE_CHANNEL: ${UPDATE_CHANNEL:-stable}
      POLL_INTERVAL_HOURS: ${POLL_INTERVAL_HOURS:-6}
      GITHUB_TOKEN: ${GITHUB_TOKEN:-}
      CURRENT_VERSION: ${CURRENT_VERSION:-0.0.0}
      AUTO_UPDATE: ${AUTO_UPDATE:-0}
      # Set 0 to hide one-click apply (the console then shows the manual upgrade steps).
      APPLY_SUPPORTED: ${APPLY_SUPPORTED:-1}
      COMPOSE_PROJECT_NAME: ${COMPOSE_PROJECT_NAME:-mdmesh}
      COMPOSE_FILE: ${COMPOSE_FILE:-docker-compose.yml}
      COMPOSE_PROFILES: ${COMPOSE_PROFILES:-}
      DB_USER: ${DB_USER:-mdmesh}
      DB_NAME: ${DB_NAME:-mdmesh}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - .:/project
      - backups:/backups

  cloudflared:
    image: cloudflare/cloudflared:latest
    restart: unless-stopped
    profiles: ["cloudflare"]
    depends_on:
      - caddy
    command: tunnel --no-autoupdate run
    environment:
      TUNNEL_TOKEN: ${TUNNEL_TOKEN:-}

volumes:
  pgdata:
  mdmeshdata:
  caddy_data:
  caddy_config:
  backups: