services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-dsh}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?set in .env}
      - POSTGRES_DB=${POSTGRES_DB:-dsh}
    volumes:
      - pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-dsh} -d ${POSTGRES_DB:-dsh}"]
      interval: 5s
      timeout: 3s
      retries: 12

  dsh-sync:
    build: .
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./data:/data          # plugin artifacts; DB lives in the pg_data volume
    environment:
      - DSH_DATABASE_URL=postgresql://${POSTGRES_USER:-dsh}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-dsh}
      # Generate once, e.g.: python -c "import secrets; print(secrets.token_hex(32))"
      - DSH_BOOTSTRAP_ADMIN_TOKEN=${DSH_BOOTSTRAP_ADMIN_TOKEN:?set in .env}
      - DSH_INVITE_CODE=${DSH_INVITE_CODE:?set in .env}
      - DSH_ADMIN_USERNAME=${DSH_ADMIN_USERNAME:-admin}
      - DSH_MAX_PLUGIN_MB=${DSH_MAX_PLUGIN_MB:-20}

  caddy:
    image: caddy:2
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - dsh-sync

volumes:
  pg_data:
  caddy_data:
  caddy_config: