version: "3.9"

services:
  nginx:
    image: nginx:latest
    ports:
      - "3000:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - frontend
      - backend
    restart: always

  frontend:
    image: git.aranroig.com/syndria98/mathew-frontend:latest
    environment:
      # Where the browser finds the Lean editor server: the site's own https
      # origin, proxied to the lean service by nginx (/api/lean). An https://
      # site needs an https:// address here — the websocket's wss:// is derived
      # from it, and an http:// server would be refused as mixed content.
      NUXT_PUBLIC_LEAN_URL: ${NUXT_PUBLIC_LEAN_URL:-https://mathew.aranroig.com/api/lean}
    restart: always

  # The Lean editor (lean4web) — its own server, since it runs a real Lean
  # process per session and asks for a dedicated machine (see lean/).
  # CI builds and pushes this image only when lean/** changes.
  lean:
    build:
      context: ./lean
      # To ship a ~4GB image that keeps Mathlib's cache in the volume below
      # instead of inside itself (filled once at first start — see the
      # "Keeping Mathlib out of the image" section of lean/README.md):
      # args:
      #   BAKE_MATHLIB: "false"
    image: git.aranroig.com/syndria98/mathew-lean:latest
    # Reachable only from this host (dev's frontend) and nginx; the public way
    # in is https://mathew.aranroig.com/api/lean. Publishing the port would
    # hand anyone on the internet a Lean shell — see lean/README.md.
    ports:
      - "127.0.0.1:8080:8080"
    restart: always
    # Only with BAKE_MATHLIB: "false" above:
    # volumes:
    #   - lean-mathlib:/opt/lean4web/Projects/MathlibDemo/.lake

  backend:
    image: git.aranroig.com/syndria98/mathew-backend:latest
    environment:
      # Production MongoDB — the LAN database server, not a container of this
      # stack and not the container's own 127.0.0.1 (where nothing listens).
      # Development keeps localhost:27017 via backend/.env.
      MONGO_URI: mongodb://192.168.1.7:27017/mathew
      # Interpolated from /var/www/app/.env on the deploy host (never
      # committed, never overwritten by the pipeline's scp). Create it once:
      #   echo "JWT_SECRET=$(openssl rand -hex 32)" >> /var/www/app/.env
      # Left unset, the backend falls back to the dev key in the repo —
      # anyone could then forge sessions against the public site.
      JWT_SECRET: ${JWT_SECRET:-}
    restart: always

# Only with the lean volume mode (uncomment together with the lean build arg
# and the lean service's volumes entry):
# volumes:
#   lean-mathlib: