networks:
  anouma-network:
    name: ${DOCKER_NETWORK:-anouma-network}

volumes:
  pgdata:

services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    networks:
      - anouma-network
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: ${POSTGRES_DB:-anouma}
    volumes:
      - pgdata:/var/lib/postgresql/data
    # Not published to the host by default - only reachable from other
    # containers on anouma-network. Uncomment to reach it from the host too
    # (e.g. with a GUI DB client) during development:
    # ports:
    #   - "127.0.0.1:5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
      interval: 5s
      timeout: 5s
      retries: 20

  app:
    # Production never builds from source - the image is built once by
    # GitHub Actions on release and pushed to GHCR; this host only
    # ever pulls a specific, already-tested tag (see deploy.sh, which is the
    # only thing that ever changes ANOUMA_IMAGE in .env).
    image: ${ANOUMA_IMAGE:-ghcr.io/whitehai11/anouma:latest}
    restart: unless-stopped
    networks:
      - anouma-network
    env_file:
      - .env
    # DATABASE_URI in .env must point at the "postgres" service name, e.g.
    # postgresql://postgres:<password>@postgres:5432/anouma - setup.sh sets
    # this up for you automatically.
    ports:
      - "127.0.0.1:${APP_PORT:-3000}:3000"
    volumes:
      - ./media:/app/media
    depends_on:
      postgres:
        condition: service_healthy
    # Container-level healthcheck is inherited from the image's own
    # HEALTHCHECK instruction (GET /api/health, which itself checks Postgres
    # connectivity) - nothing to duplicate here.

  # Self-hosted LiveKit SFU. Host networking is intentional: WebRTC media
  # needs the UDP port range below to be reachable directly from the internet.
  livekit:
    image: livekit/livekit-server:latest
    restart: unless-stopped
    network_mode: host
    env_file:
      - .env
    environment:
      LIVEKIT_CONFIG: |
        port: 7880
        log_level: info
        rtc:
          tcp_port: 7881
          port_range_start: 50000
          port_range_end: 60000
          use_external_ip: true
        keys:
          ${LIVEKIT_API_KEY}: ${LIVEKIT_API_SECRET}
        turn:
          enabled: true
          udp_port: 3478

  # Optional external network to a reverse proxy (e.g. Nginx Proxy Manager)
  # is attached via docker-compose.override.yml, generated by setup.sh only
  # when such a network is actually detected - see DEPLOYMENT.md. Nothing
  # here assumes NPM (or any reverse proxy) exists.