services:

  stoa-backend:
    image: ghcr.io/the-d-b/stoa-backend:latest
    container_name: stoa-backend
    volumes:
      - stoa-data:/data
      # Docker control panel — mount WITHOUT :ro (start/stop/restart need write access)
      # - /var/run/docker.sock:/var/run/docker.sock
      # Private CA certificates — avoids needing "Skip TLS verify" on internal services
      # - /usr/local/share/ca-certificates:/usr/local/share/ca-certificates:ro
    environment:
      # ── Required ──────────────────────────────────────────────────────────────
      # Signs JWTs and derives the AES-256 key for encrypting stored secrets.
      # Generate with: openssl rand -hex 32
      STOA_SESSION_SECRET: "change-me-use-openssl-rand-hex-32"

      # ── Optional: paths ───────────────────────────────────────────────────────
      # STOA_DB_PATH: /data/db/stoa.db          # default
      # STOA_PORT: "8080"                        # default
      # STOA_ICONS_DIR: /data/icons              # default
      # STOA_CSS_DIR: /data/css                  # default

      # ── Optional: CORS ────────────────────────────────────────────────────────
      # Required if your reverse proxy rewrites the Host header or if you access
      # the API from a different origin than the frontend.
      # STOA_ALLOWED_ORIGINS: "https://stoa.example.com"

      # ── Optional: OAuth / OIDC ───────────────────────────────────────────────
      # See docs/oauth.md for full setup instructions.
      # STOA_OAUTH_CLIENT_ID: ""
      # STOA_OAUTH_CLIENT_SECRET: ""
      # STOA_OAUTH_ISSUER_URL: "https://auth.example.com/application/o/stoa/"
      # STOA_OAUTH_REDIRECT_URL: "https://stoa.example.com/api/auth/callback"

    restart: unless-stopped
    networks:
      - stoa-net
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

  stoa-frontend:
    image: ghcr.io/the-d-b/stoa-frontend:latest
    container_name: stoa-frontend
    ports:
      - "8080:80"
    depends_on:
      - stoa-backend
    restart: unless-stopped
    networks:
      - stoa-net

networks:
  stoa-net:
    driver: bridge

volumes:
  stoa-data:
    driver: local