services:
  paldex:
    build: .
    image: paldex:latest
    # Without this, `docker compose pull` (which Portainer's stack
    # auto-update runs before redeploying) tries to pull "paldex:latest"
    # from a registry — it doesn't exist anywhere but as a local build, so
    # every auto-update cycle failed with "pull access denied" and silently
    # retried forever. This tells compose to always build instead of pull.
    pull_policy: build
    restart: unless-stopped
    ports:
      - "30024:5151"
    environment:
      - RCON_PASSWORD=${RCON_PASSWORD}
      - AMP_HOST=${AMP_HOST}
      - AMP_USER=${AMP_USER}
      - AMP_SAVE_ROOT=${AMP_SAVE_ROOT}
      - AMP_WORLD_GUID=${AMP_WORLD_GUID}
    volumes:
      # Mounted only at data/live/ (not all of /app/data) so the image's
      # baked-in data/*_static.json (schematics/relics/etc., refreshed by
      # every rebuild) is never shadowed by stale volume content — only the
      # refresh loop's own players.json/bases.json/dungeons_state.json and
      # the data/saves/ save-file cache persist here across restarts.
      - paldex_data:/app/data/live
      - ${PALDEX_SSH_KEY_HOST_PATH:-./deploy/paldex_deploy_key}:/run/secrets/paldex_ssh_key:ro

volumes:
  paldex_data: