version: "3.9"

services:
  nginx:
    image: nginx:latest
    ports:
      - "3000:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - frontend
      - backend
    restart: always

  frontend:
    image: git.aranroig.com/syndria98/mathew-frontend:latest
    environment:
      # Where the browser finds the Lean editor server below (the wiki's
      # /lean frames it). An https:// site needs an https:// address here,
      # or the browser refuses the frame — see lean/README.md.
      NUXT_PUBLIC_LEAN_URL: ${NUXT_PUBLIC_LEAN_URL:-http://mathew.aranroig.com:8080}
    restart: always

  # The Lean editor (lean4web) — its own server, since it runs a real Lean
  # process per session and asks for a dedicated machine (see lean/).
  # CI builds and pushes this image only when lean/** changes.
  lean:
    build:
      context: ./lean
      # To ship a ~4GB image that keeps Mathlib's cache in the volume below
      # instead of inside itself (filled once at first start — see the
      # "Keeping Mathlib out of the image" section of lean/README.md):
      # args:
      #   BAKE_MATHLIB: "false"
    image: git.aranroig.com/syndria98/mathew-lean:latest
    ports:
      - "8080:8080"
    restart: always
    # Only with BAKE_MATHLIB: "false" above:
    # volumes:
    #   - lean-mathlib:/opt/lean4web/Projects/MathlibDemo/.lake

  backend:
    image: git.aranroig.com/syndria98/mathew-backend:latest
    environment:
      # Production MongoDB — the LAN database server, not a container of this
      # stack and not the container's own 127.0.0.1 (where nothing listens).
      # Development keeps localhost:27017 via backend/.env.
      MONGO_URI: mongodb://192.168.1.7:27017/mathew
      # Interpolated from /var/www/app/.env on the deploy host (never
      # committed, never overwritten by the pipeline's scp). Create it once:
      #   echo "JWT_SECRET=$(openssl rand -hex 32)" >> /var/www/app/.env
      # Left unset, the backend falls back to the dev key in the repo —
      # anyone could then forge sessions against the public site.
      JWT_SECRET: ${JWT_SECRET:-}
    restart: always

# Only with the lean volume mode (uncomment together with the lean build arg
# and the lean service's volumes entry):
# volumes:
#   lean-mathlib: