# The public demo, demo.runicgateway.com (docs/website/DEMO_MODE.md).
#
# The same image as every other deployment, switched by DEMO_MODE=true (§2). Only
# the app and its database: no bot and no ntfy, because the demo sends nothing
# outward (§5). The wipe workflow (.gitea/workflows/demo-wipe.yml) copies this
# file into the deploy directory on the `demo-site` host and runs it from there;
# the host's own `.env` beside it holds every secret.
#
# The project name is fixed so the network is `rg-demo_default` whatever the
# directory is called: the workflow's smoke check joins it to reach the app.
name: rg-demo

services:
  db:
    image: mariadb:11
    restart: unless-stopped
    environment:
      MARIADB_DATABASE: ${DB_NAME}
      MARIADB_USER: ${DB_USER}
      MARIADB_PASSWORD: ${DB_PASSWORD}
      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
    volumes:
      # Dropped at every wipe (`down -v`) with the uploads volume: that is the wipe.
      - dbdata:/var/lib/mysql
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 10

  app:
    image: gitea.whitlocktech.com/runicgateway/website-app:${IMAGE_TAG:-latest}
    restart: unless-stopped
    # modules.env is written by the wipe (rig.mjs plan): MODULES=rust@<version>=…,
    # the newest Module-Rust release on the bundle's protocol (§7.5). Kept out of
    # .env so the workflow never edits the file holding the secrets.
    env_file:
      - .env
      - state/modules.env
    environment:
      DEMO_MODE: "true"
      DB_HOST: db
      UPLOAD_DIR: /app/uploads
      LOG_DIR: /app/logs
      MODULES_DIR: /app/modules
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - uploads:/app/uploads
      - ./logs:/app/logs
      # A bind mount, not a volume, so `down -v` keeps the unpacked module and a
      # wipe does not download it again. Must be writable by uid 1000.
      - ./modules:/app/modules
      # The seed fixture (§7.3), read by `seed:demo` after every wipe.
      - ./seed.json:/app/deploy/demo/seed.json:ro
    # Busybox wget is in the Alpine image; `/status` answers once the server listens.
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/api/v1/public/status"]
      interval: 10s
      timeout: 5s
      start_period: 30s
      retries: 30
    # The external reverse proxy (DNS + HTTPS) forwards here.
    ports:
      - "${DEMO_HOST_PORT:-3000}:3000"

volumes:
  dbdata:
  uploads: