# BetterFrame stack: server + Angie proxy + Node-RED.
# Kiosk runs on the Pi natively (not in Docker, needs Wayland/HDMI).
#
# Usage:
#   docker compose -f deploy/docker/docker-compose.yml up -d --build
#
# Volumes:
#   betterframe-data: sqlite DB + secret.key
#   nodered-data: Node-RED flows
#
# Only 0.0.0.0:80 is published on the host. Backend services and Node-RED
# are reachable only from within the Docker network.
version: "3.8"

services:
  server:
    build:
      context: ../..
      dockerfile: deploy/docker/Dockerfile.server
    container_name: betterframe-server
    restart: unless-stopped
    # Env overrides win over sec-config.yaml — Coolify / k8s inject these.
    environment:
      - TZ=UTC
      - BF_DATA_DIR=/var/lib/betterframe
      - BF_SQLITE_PATH=/var/lib/betterframe/betterframe.db
      - BF_NODERED_URL=http://nodered:1880
      - BF_SELF_URL=http://server:18080
      # Optional: paste Ed25519 PEM private key here for firmware signing.
      # - BF_FIRMWARE_SIGNING_KEY=
      # Optional MQTT telemetry bridge (ThingsBoard / HA / Influx / etc).
      # - BF_MQTT_URL=mqtt://broker:1883
      # - BF_MQTT_USERNAME=
      # - BF_MQTT_PASSWORD=
      # - BF_MQTT_TOPIC_PREFIX=betterframe
    volumes:
      - betterframe-data:/var/lib/betterframe
      - ./sec-config.yaml:/app/server/sec-config.yaml:ro
    expose:
      - "18080"
      - "18081"
      - "18082"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:18080/healthz || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    networks:
      - betterframe

  angie:
    image: nginx:alpine
    container_name: betterframe-angie
    restart: unless-stopped
    depends_on:
      - server
      - nodered
    ports:
      - "80:80"
    volumes:
      - ../angie/betterframe.docker.conf:/etc/nginx/conf.d/default.conf:ro
    networks:
      - betterframe

  nodered:
    build:
      context: ../..
      dockerfile: deploy/docker/Dockerfile.nodered
    container_name: betterframe-nodered
    restart: unless-stopped
    environment:
      - TZ=UTC
    volumes:
      - nodered-data:/data
      - ./nodered-settings.js:/data/settings.js:ro
    expose:
      - "1880"
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:1880/nrdp/auth/login >/dev/null || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s
    networks:
      - betterframe

volumes:
  betterframe-data:
  nodered-data:

networks:
  betterframe:
    driver: bridge