services:
  web:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        # Pull the base image through the Nexus docker-group proxy. Override per
        # environment, e.g. NODE_IMAGE=node:20-slim docker compose build.
        NODE_IMAGE: node:20-slim
        # Optional Nexus npm-group token, consumed only by the deps stage.
        NPM_TOKEN: ${NPM_TOKEN:-}
    image: soroushasadi-site:latest
    container_name: soroushasadi-site
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      NODE_ENV: production
      DATA_DIR: /data
      # Set these in a sibling .env file (NOT committed) or your host env.
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?set ADMIN_PASSWORD}
      ADMIN_SESSION_SECRET: ${ADMIN_SESSION_SECRET:?set ADMIN_SESSION_SECRET}
      RESEND_API_KEY: ${RESEND_API_KEY:-}
      CONTACT_INBOX: ${CONTACT_INBOX:-}
      CONTACT_FROM: ${CONTACT_FROM:-}
    volumes:
      # SQLite content DB + uploaded media persist across rebuilds.
      - cms-data:/data
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s

volumes:
  cms-data: