docker-compose.yml

version: '3.8'

services:
  # Main application (internal, not exposed directly)
  app:
    build: .
    container_name: vdv463-validator-app
    restart: unless-stopped
    environment:
      # Authentication
      - AUTH_SECRET=${AUTH_SECRET:-}
      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
      # Set to true to disable all authentication (internal/trusted networks only!)
      - DISABLE_AUTH=${DISABLE_AUTH:-false}
      - ADMIN_EMAILS=${ADMIN_EMAILS:-}


      # Google OAuth (optional)
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}

      # Email configuration (optional)
      - SMTP_HOST=${SMTP_HOST:-}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_USER=${SMTP_USER:-}
      - SMTP_PASSWORD=${SMTP_PASSWORD:-}

      # Application URL (used for email links)
      - APP_URL=${APP_URL:-https://localhost}

      # CORS origins (your domain)
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-https://localhost}
    volumes:
      - app_data:/home/validator/app/web/backend/data
    networks:
      - internal
    expose:
      - "8000"
    healthcheck:
      test: [ "CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:8000/api/health" ]
      interval: 30s
      timeout: 10s
      retries: 3

  # Nginx reverse proxy with SSL termination
  nginx:
    image: nginx:alpine
    container_name: vdv463-validator-nginx
    restart: unless-stopped
    ports:
      - "${HTTPS_PORT:-443}:443"
      - "${HTTP_PORT:-80}:80"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    depends_on:
      app:
        condition: service_healthy
    networks:
      - internal

networks:
  internal:
    driver: bridge

volumes:
  app_data:
    driver: local