name: wacrm

services:
  app:
    build:
      context: .
      # NEXT_PUBLIC_* vars are inlined at build time — forward them
      # from .env.local as build args. Changing any of them requires
      # a rebuild (docker compose up --build).
      args:
        NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
        NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:-}
        NEXT_PUBLIC_APP_LOCALE: ${NEXT_PUBLIC_APP_LOCALE:-en}
    # Runtime (server-only) secrets come from .env.local; they are
    # never baked into the image.
    env_file:
      - .env.local
    ports:
      - "${PORT:-3000}:3000"
    restart: unless-stopped
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://localhost:3000').then((r)=>process.exit(r.ok||r.status<500?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s