# The GregKilmer.com stack on Cosmos: content service, admin page and public site.
#
# Lives at /home/greg/homelab/gregkilmer/compose.yaml (the Gitea Actions deploy
# copies it there from deploy/compose.yaml on every build). Settings:
#   .env          stack settings: GK_TAG, VAULT_SITE, PUID, PGID (deploy/stack.env.example)
#   content.env   content service secrets (services/content/.env.example)
#   admin.env     admin page settings (deploy/admin.env.example)
#   site.env      public site secrets (services/site/.env.example)
#
# No service publishes a host port. Nginx Proxy Manager reaches them by
# container name on homelab_network. See docs/deploy.md.

name: gregkilmer

x-common: &common
  restart: unless-stopped
  user: "${PUID:-1000}:${PGID:-1000}"
  networks: [homelab_network]
  read_only: true
  tmpfs: [/tmp]
  security_opt: ["no-new-privileges:true"]
  cap_drop: [ALL]

services:
  gk-content:
    <<: *common
    image: gregkilmer/content:${GK_TAG:?set GK_TAG in .env}
    container_name: gk-content
    env_file: content.env
    environment:
      SITE_DIR: /vault/Site
      DATA_DIR: /data
    volumes:
      # The vault's Site folder. Read-write: accepted API and MCP changes are
      # written back into the notes.
      - ${VAULT_SITE:?set VAULT_SITE in .env}:/vault/Site
      # content.db (notes, history, review queue, saved forms, sync cache) and
      # submissions/ (form attachments). Both are backed up.
      - ./data/content:/data
    labels:
      backup.dump: sqlite

  gk-admin:
    <<: *common
    image: gregkilmer/admin:${GK_TAG}
    container_name: gk-admin
    env_file: admin.env
    environment:
      CONTENT_URL: http://gk-content:4310
    depends_on:
      gk-content: { condition: service_healthy }

  gk-site:
    <<: *common
    image: gregkilmer/site:${GK_TAG}
    container_name: gk-site
    env_file: site.env
    environment:
      CONTENT_URL: http://gk-content:4310
    depends_on:
      gk-content: { condition: service_healthy }

networks:
  homelab_network:
    name: homelab_network
    external: true