services:
  backend:
    restart: unless-stopped
    image: ${CONVEX_IMAGE:-ghcr.io/get-convex/convex-backend@sha256:3aa2ccd6697a75de53948b1ee531d7c9688fe09ef360748d75df46dfc888f69a}
    stop_signal: SIGINT
    stop_grace_period: 20s
    ports:
      - "${CONVEX_BIND_ADDRESS:-127.0.0.1}:${CONVEX_PORT:-3210}:3210"
      - "127.0.0.1:${CONVEX_SITE_PORT:-3211}:3211"
    volumes:
      - convex-data:/convex/data
    environment:
      CONVEX_CLOUD_ORIGIN: ${PUBLIC_CONVEX_URL:-http://localhost:3210}
      CONVEX_SITE_ORIGIN: ${CONVEX_SITE_ORIGIN:-http://localhost:3211}
      DISABLE_BEACON: "true"
      DISABLE_METRICS_ENDPOINT: "true"
      REDACT_LOGS_TO_CLIENT: "true"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3210/version"]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 10s
  dashboard:
    profiles: ["admin"]
    image: ${CONVEX_DASHBOARD_IMAGE:-ghcr.io/get-convex/convex-dashboard@sha256:63e94c62940a09acd36464e02e1b0a7589f7ef48227003de78510f9523bb4e6b}
    ports: ["127.0.0.1:6791:6791"]
    environment:
      NEXT_PUBLIC_DEPLOYMENT_URL: ${PUBLIC_CONVEX_URL:-http://localhost:3210}
    depends_on:
      backend: { condition: service_healthy }
  web:
    restart: unless-stopped
    build: .
    ports: ["${WEB_BIND_ADDRESS:-127.0.0.1}:${WEB_PORT:-3000}:3000"]
    environment:
      APP_MODE: ${APP_MODE:-live}
      APP_RELEASE_ID: ${APP_RELEASE_ID:-local}
      APP_CAPABILITY_ALLOWLIST: ${APP_CAPABILITY_ALLOWLIST-asset_search,asset_valuation,asset_sync,assistant_dispatch,session_token,identity,subscriptions}
      ORIGIN: ${APP_ORIGIN:-http://localhost:3000}
      APP_ORIGIN: ${APP_ORIGIN:-http://localhost:3000}
      CONVEX_URL: http://backend:3210
      PUBLIC_CONVEX_URL: ${PUBLIC_CONVEX_URL:-http://localhost:3210}
      CONVEX_BRIDGE_SECRET: ${CONVEX_BRIDGE_SECRET:-}
      APP_AUTH_ISSUER: ${APP_AUTH_ISSUER:-http://localhost:3000}
      APP_AUTH_PRIVATE_KEY: ${APP_AUTH_PRIVATE_KEY:-}
      TOKEN_ENCRYPTION_KEY: ${TOKEN_ENCRYPTION_KEY:-}
      EVE_CLIENT_ID: ${EVE_CLIENT_ID:-}
      EVE_CLIENT_SECRET: ${EVE_CLIENT_SECRET:-}
      EVE_CALLBACK_URL: ${EVE_CALLBACK_URL:-http://localhost:3000/auth/eve/callback}
      ESI_USER_AGENT: ${ESI_USER_AGENT:-EVE-Intelligence/0.1 (configure operator contact)}
      TYPESAFE_API_KEY: ${TYPESAFE_API_KEY:-}
      REFERENCE_DIR: /app/data/reference
    volumes: ["reference-data:/app/data/reference:ro"]
    depends_on:
      backend: { condition: service_healthy }
  sync-worker:
    profiles: ["worker"]
    restart: unless-stopped
    build: .
    command: ["bun", "scripts/run-sync-worker.ts"]
    environment:
      CONVEX_URL: http://backend:3210
      CONVEX_SYNC_WORKER_SECRET: ${CONVEX_SYNC_WORKER_SECRET:-}
      TOKEN_ENCRYPTION_KEY: ${TOKEN_ENCRYPTION_KEY:-}
      EVE_CLIENT_ID: ${EVE_CLIENT_ID:-}
      EVE_CLIENT_SECRET: ${EVE_CLIENT_SECRET:-}
      EVE_CALLBACK_URL: ${EVE_CALLBACK_URL:-http://localhost/unused-worker-callback}
      ESI_USER_AGENT: ${ESI_USER_AGENT:-EVE-Intelligence/0.1 (configure operator contact)}
      SYNC_WORKER_ID: ${SYNC_WORKER_ID:-local-sync-worker}
      SYNC_WORKER_LEASE_MS: ${SYNC_WORKER_LEASE_MS:-600000}
      SYNC_WORKER_HEARTBEAT_MS: ${SYNC_WORKER_HEARTBEAT_MS:-60000}
      SYNC_WORKER_POLL_MS: ${SYNC_WORKER_POLL_MS:-1000}
    depends_on:
      backend: { condition: service_healthy }
  reference-worker:
    profiles: ["tools"]
    build: .
    # Production is explicit via the tools profile; fixture imports require an override.
    command: ["bun", "workers/reference.ts", "--production", "--directory", "/app/data/reference"]
    environment:
      REFERENCE_DIR: /app/data/reference
      REFERENCE_LIVE_DIR: /app/data/reference/archives
    volumes: ["reference-data:/app/data/reference"]
volumes:
  convex-data:
  reference-data: