services:
  postgres:
    image: postgres:18.6-alpine@sha256:10a5c69a83035ab5239f5620d708520e8b28f5aa1f2b20143e6024532edadfb5
    environment:
      POSTGRES_DB: divetracx
      POSTGRES_USER: divetracx
      POSTGRES_PASSWORD: divetracx
      # PostgreSQL 18 defaults outside the legacy mount unless PGDATA is explicit.
      PGDATA: /var/lib/postgresql/data
    ports:
      - "127.0.0.1:5433:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U divetracx -d divetracx"]
      interval: 3s
      timeout: 3s
      retries: 20
    volumes:
      - divetracx-postgres:/var/lib/postgresql/data

  app:
    build: .
    environment:
      DATABASE_URL: postgresql://divetracx:divetracx@postgres:5432/divetracx
      STORAGE_PROVIDER: local
      STORAGE_PATH: /uploads
      STORAGE_URL: /media
      # Private MCP clients on this Compose network use the app hostname.
      MCP_ALLOWED_HOSTS: ${MCP_ALLOWED_HOSTS:-app}
      MCP_ALLOWED_ORIGINS: ${MCP_ALLOWED_ORIGINS:-}
    expose:
      - "3000"
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - divetracx-uploads:/uploads

  hodor:
    image: ${HODOR_IMAGE:-ghcr.io/michidk/hodor@sha256:133a617076bea11ea1b7e41a93145bfd2867516f4b865e37fa3bf41638a65cf7}
    restart: unless-stopped
    depends_on:
      - app
    ports:
      - "${HODOR_PORT:-3000}:8080"
    environment:
      PASSWORD: ${HODOR_PASSWORD:?Set HODOR_PASSWORD in .env}
      SECRET: ${HODOR_SECRET:?Set HODOR_SECRET in .env}
      UPSTREAM: http://app:3000
      TITLE: ${HODOR_TITLE:-Divetracx Login}
      SESSION_TTL: ${HODOR_SESSION_TTL:-86400}
      SECURE_COOKIE: ${HODOR_SECURE_COOKIE:-false}
      LOG_FORMAT: ${HODOR_LOG_FORMAT:-compact}

volumes:
  divetracx-postgres:
  divetracx-uploads: