name: wacrm

services:
  app:
    build:
      context: .
      # NEXT_PUBLIC_* vars are inlined at build time — forward them
      # from .env.local as build args. Changing any of them requires
      # a rebuild (docker compose up --build).
      args:
        NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:-}
        NEXT_PUBLIC_APP_LOCALE: ${NEXT_PUBLIC_APP_LOCALE:-en}
    # Runtime (server-only) secrets come from .env.local; they are
    # never baked into the image.
    env_file:
      - .env.local
    # The server always listens on 3000 inside the container. Pinned
    # here because `environment` wins over `env_file`, so a stray PORT
    # in .env.local can't desync the app from the mapping and the
    # healthcheck below.
    environment:
      PORT: 3000
    # Host side only — HOST_PORT=8080 publishes the app on :8080.
    ports:
      - '${HOST_PORT:-3000}:3000'
    restart: unless-stopped
    healthcheck:
      test:
        [
          'CMD',
          'node',
          '-e',
          "fetch('http://localhost:3000').then((r)=>process.exit(r.ok||r.status<500?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s