# Waters Boards on the AWS Lightsail box.
#
# This file is copied to /opt/waters-boards/ on the box (deploy/aws/deploy.sh does it), and
# sits there next to:
#   .env         secrets, created by hand once, never overwritten by a deploy
#   data/        database, uploads and nightly backups, never touched by a deploy
#   Caddyfile    the reverse-proxy config from this folder
#   server/      the app source, rsynced from ../../server
# "build: ./server" and "./data" below are relative to that folder, not to this repo.

services:
  boards:
    build: ./server
    image: waters-boards:latest
    container_name: waters-boards
    restart: unless-stopped
    env_file:
      - ./.env
    volumes:
      # Database (boards.db), uploaded files and nightly backups.
      - ./data:/app/data
    # Reachable only from Caddy on the compose network. No "ports": the app is never public.
    expose:
      - "3100"

  caddy:
    image: caddy:2.10-alpine
    container_name: waters-caddy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"   # HTTP/3
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      # Certificates and Caddy's state. Keep these volumes, or Caddy has to re-issue the
      # certificate on every restart and Let's Encrypt will rate-limit it.
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - boards

volumes:
  caddy_data:
  caddy_config: