services:
  api:
    build: ./api
    # .env.example holds safe defaults (committed); an untracked ./api/.env layered on top
    # supplies real secrets (MINIO_SECRET_KEY) — see api/.env.example.
    env_file:
      - ./api/.env.example
      - path: ./api/.env
        required: false
    depends_on:
      - postgres
      - redis
    expose:
      - "3000"
    restart: unless-stopped

  frontend:
    build: ./frontend
    env_file: ./frontend/.env.example
    depends_on:
      - api
    expose:
      - "3001"
    restart: unless-stopped

  worker:
    build: ./worker
    env_file:
      - ./worker/.env.example
      - path: ./worker/.env
        required: false
    depends_on:
      - postgres
      - redis
    restart: unless-stopped
    # Scale render capacity locally with, e.g.: docker compose up --scale worker=3
    # A `worker` can also run standalone on a separate machine, pointed at the same
    # postgres/redis/minio over a private network (VPN/Tailscale/LAN) — see README.
    #
    # RENDER_BACKEND=gpu/hybrid (worker/.env.example, Phase 8) needs the container to actually
    # see a GPU — the nvidia-container-toolkit must be installed on the host, then uncomment:
    # deploy:
    #   resources:
    #     reservations:
    #       devices:
    #         - driver: nvidia
    #           count: 1
    #           capabilities: [gpu]
    # Default RENDER_BACKEND=cpu needs none of this — GPU rendering is opt-in, not required.

  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: mcmapper
      POSTGRES_PASSWORD: mcmapper
      POSTGRES_DB: mcmapper
    volumes:
      - postgres-data:/var/lib/postgresql/data
    restart: unless-stopped
    # Intentionally no `ports:` — only reachable on the compose network / a private
    # network for remote workers, never exposed publicly.

  redis:
    image: redis:7-alpine
    volumes:
      - redis-data:/data
    restart: unless-stopped
    # Same rule as postgres: no public ports.

  # No `minio` service here: rendered tiles/meshes are stored in a dedicated bucket
  # (`mcmapper-tiles`) on an existing shared MinIO instance instead of a per-stack container —
  # see api/.env.example and worker/.env.example for the endpoint/credentials, and README.md
  # for how that bucket + scoped access key were provisioned.

  caddy:
    image: caddy:2-alpine
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy-data:/data
    ports:
      - "80:80"
      - "443:443"
    depends_on:
      - api
      - frontend
    restart: unless-stopped

volumes:
  postgres-data:
  redis-data:
  caddy-data: