version: "3.9"

services:
  nginx:
    image: nginx:latest
    ports:
      - "3000:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - frontend
      - backend
    restart: always

  frontend:
    image: git.aranroig.com/syndria98/mathew-frontend:latest
    environment:
      # Where the browser finds the Lean editor server below (the wiki's
      # /lean frames it). An https:// site needs an https:// address here,
      # or the browser refuses the frame — see lean/README.md.
      NUXT_PUBLIC_LEAN_URL: ${NUXT_PUBLIC_LEAN_URL:-http://mathew.aranroig.com:8080}
    restart: always

  # The Lean editor (lean4web) — its own server, since it runs a real Lean
  # process per session and asks for a dedicated machine (see lean/).
  lean:
    build: ./lean
    image: mathew-lean:latest
    ports:
      - "8080:8080"
    restart: always

  backend:
    image: git.aranroig.com/syndria98/mathew-backend:latest
    environment:
      # Production MongoDB — the LAN database server, not a container of this
      # stack and not the container's own 127.0.0.1 (where nothing listens).
      # Development keeps localhost:27017 via backend/.env.
      MONGO_URI: mongodb://192.168.1.7:27017/mathew
      # Interpolated from /var/www/app/.env on the deploy host (never
      # committed, never overwritten by the pipeline's scp). Create it once:
      #   echo "JWT_SECRET=$(openssl rand -hex 32)" >> /var/www/app/.env
      # Left unset, the backend falls back to the dev key in the repo —
      # anyone could then forge sessions against the public site.
      JWT_SECRET: ${JWT_SECRET:-}
    restart: always