services:
  patzer:
    # Pulls the published image from Docker Hub by default (rebuilt on every
    # push to main by .github/workflows/docker-publish.yml). To build from
    # local source instead, uncomment `build: .` and run `docker compose build`.
    image: sikamikaniko123/patzer:latest
    # build: .
    container_name: patzer
    restart: unless-stopped
    ports:
      - "${HOST_PORT:-8800}:8800"
    # Linux + Ollama on this same machine: uncomment these two lines to reach
    # it as http://host.docker.internal:11434 (Docker Desktop on Windows/Mac
    # has that name built in). Needs Docker 20.10+, and Ollama must listen on
    # the network (OLLAMA_HOST=0.0.0.0). Your LAN IP works without this too.
    # extra_hosts:
    #   - "host.docker.internal:host-gateway"
    volumes:
      - patzer-data:/app/data
    environment:
      - NODE_ENV=production
      # Analysis engine backend. `local` (default) uses the bundled Stockfish
      # binary; set ENGINE_BACKEND=chessapi (e.g. via a .env file) to opt in to
      # the hosted chess-api.com engine — the knob for a public try-it instance
      # (DEMO_MODE, #27).
      - ENGINE_BACKEND=${ENGINE_BACKEND:-local}
      # Behind a reverse proxy: the public address, and Secure cookies for HTTPS.
      - PUBLIC_BASE_URL=${PUBLIC_BASE_URL:-}
      - COOKIE_SECURE=${COOKIE_SECURE:-false}
      # Single sign-on through Authentik, Keycloak or any OpenID Connect
      # provider; off until OIDC_ISSUER and OIDC_CLIENT_ID are set (e.g. in a
      # .env file next to this one). Every variable is explained in docs/OIDC.md.
      - OIDC_ISSUER=${OIDC_ISSUER:-}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
      - OIDC_BUTTON_TEXT=${OIDC_BUTTON_TEXT:-}
      - OIDC_ONLY=${OIDC_ONLY:-false}
      - OIDC_ADMIN_GROUP=${OIDC_ADMIN_GROUP:-}
      - OIDC_AUTO_PROVISION=${OIDC_AUTO_PROVISION:-false}
      - OIDC_MATCH_BY=${OIDC_MATCH_BY:-none}
      # PORT/HOST/DB_PATH/STOCKFISH_PATH have sensible defaults baked into the image.
    labels:
      # Opt this container in to the (label-enabled) Watchtower on the host, so
      # a new `:latest` on Docker Hub is pulled and the container recreated
      # automatically. The named volume below keeps the SQLite DB across that.
      - "com.centurylinklabs.watchtower.enable=true"
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:8800/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    # Without these caps the json-file driver grows logs unbounded on the host.
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  patzer-data: