services:
  famlin-db:
    image: postgres:16-alpine
    container_name: famlin-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: famlin
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
      POSTGRES_DB: famlin
    volumes:
      - famlin-db-data:/var/lib/postgresql/data
    # No `ports:` mapping — famlin-backend reaches Postgres over the compose
    # network by service name. Publishing 5432 to the host would expose the
    # database to the whole LAN (or further, if the host forwards ports).
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U famlin -d famlin"]
      interval: 5s
      timeout: 5s
      retries: 5

  famlin-backend:
    # Pre-built, versioned image published by .github/workflows/docker-publish.yml
    # on every GitHub release. Pin FAMLIN_VERSION (e.g. 1.2.0) instead of `latest`
    # if you want updates to be a deliberate, reviewed step. To build from
    # ./backend instead, see docs/docs/maintenance.md#building-from-source-instead.
    image: ghcr.io/timvanonckelen/famlin:${FAMLIN_VERSION:-latest}
    container_name: famlin-backend
    restart: unless-stopped
    depends_on:
      famlin-db:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: 3000
      DATABASE_URL: postgresql://famlin:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}@famlin-db:5432/famlin?schema=public
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
      # Set to true only if this container sits behind a reverse proxy that
      # sets (and overwrites) X-Forwarded-*, e.g. nginx/Caddy/Traefik in front
      # of it — see backend/.env.example.
      TRUST_PROXY: ${TRUST_PROXY:-false}
    volumes:
      - famlin-uploads:/app/uploads
    ports:
      - "3000:3000"

volumes:
  famlin-db-data:
  famlin-uploads: