services:
  server:
    build:
      context: .
      dockerfile: apps/server/Dockerfile
    env_file: .env
    # Disable IPv6 in the container. Docker Desktop / WSL2 often assign an IPv6
    # address with no working IPv6 route, which makes MSAL's token request to
    # login.microsoftonline.com fail with ENETUNREACH even though IPv4 works.
    # Forcing IPv4-only outbound avoids that. Remove only if you know your
    # container has a working IPv6 route.
    sysctls:
      - net.ipv6.conf.all.disable_ipv6=1
      - net.ipv6.conf.default.disable_ipv6=1
    ports:
      - "4000:4000"
    restart: unless-stopped
    # /api/health answers as soon as Fastify is listening (it does not wait on a
    # tenant load), so this reports "is the API up", which is what `web` needs.
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://127.0.0.1:4000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 30s
      timeout: 5s
      start_period: 10s
      retries: 3

  web:
    build:
      context: .
      dockerfile: apps/web/Dockerfile
    ports:
      - "8080:80"
    # nginx proxies /api to the server, so wait for it to pass its healthcheck --
    # a plain `depends_on` only waits for the container to be created, which used
    # to let the first page load 502.
    depends_on:
      server:
        condition: service_healthy
    restart: unless-stopped