# GoWave + PostgreSQL. Settings live in .env next to this file (see .env.docker.example).
# Update: docker compose pull && docker compose up -d
# Build locally instead of pulling: docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build
name: gowave

services:
  gowave:
    image: ${GOWAVE_IMAGE:-ghcr.io/aaasazan/gowave:latest}
    container_name: gowave
    # Other containers on gowave-network (the subscription page) reach the
    # panel at http://gowave:3000.
    hostname: gowave
    user: "10001:10001"
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=128m
    restart: unless-stopped
    env_file: .env
    networks:
      - gowave-network
    ports:
      # Loopback only: put Caddy/Nginx with HTTPS in front of the panel
      - "127.0.0.1:${APP_PORT:-3000}:3000"
      # Metrics stay on loopback; set METRICS_USER/METRICS_PASS to scrape them
      - "127.0.0.1:${METRICS_PORT:-3001}:3001"
    environment:
      # These override .env: inside the container the panel always uses the
      # bundled PostgreSQL and fixed ports.
      - APP_HOST=0.0.0.0
      - APP_PORT=3000
      - METRICS_PORT=3001
      - APP_SECRET=${APP_SECRET:?Set APP_SECRET in .env (openssl rand -hex 32)}
      - DB_DRIVER=postgres
      - DATABASE_URL=postgresql://${POSTGRES_USER:-gowave}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@postgres:5432/${POSTGRES_DB:-gowave}?sslmode=disable
      - IN_DOCKER=true
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/api/system/health"]
      interval: 10s
      timeout: 5s
      start_period: 20s
      retries: 3

  postgres:
    image: postgres:18
    container_name: gowave-postgres
    hostname: gowave-postgres
    restart: unless-stopped
    networks:
      - gowave-network
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-gowave}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
      - POSTGRES_DB=${POSTGRES_DB:-gowave}
    volumes:
      # PostgreSQL 18+ keeps data in /var/lib/postgresql/18/docker, so the
      # volume is mounted one level up (not at /var/lib/postgresql/data).
      - postgres_data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U ${POSTGRES_USER:-gowave} -d ${POSTGRES_DB:-gowave}"]
      interval: 5s
      timeout: 5s
      retries: 5
    ports:
      # Exposes Postgres port on 127.0.0.1 for migrations, backup and administration
      - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"

networks:
  # A fixed name, so a separate compose file (the subscription page) can join
  # it as an external network.
  gowave-network:
    name: gowave-network
    driver: bridge

volumes:
  postgres_data: