services:
  app:
    build:
      context: .
      target: app
    environment:
      NODE_ENV: production
      SERVER_PORT: 3000
      DB_DIR: /data
      TZ: ${TZ:-UTC}
      CORS_ORIGINS: http://localhost:3000,http://127.0.0.1:3000
      ADMIN_AUTH_MODE: ${ADMIN_AUTH_MODE:-both}
      ADMIN_USERNAME: ${ADMIN_USERNAME:-}
      ADMIN_PASSWORD_HASH: ${ADMIN_PASSWORD_HASH:-}
      ADMIN_SESSION_SECRET: ${ADMIN_SESSION_SECRET:-change-me}
      ADMIN_SESSION_TTL_HOURS: ${ADMIN_SESSION_TTL_HOURS:-12}
      ADMIN_API_TOKEN_TTL_DAYS: ${ADMIN_API_TOKEN_TTL_DAYS:-30}
      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL:-}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-}
      OIDC_ALLOWED_EMAILS: ${OIDC_ALLOWED_EMAILS:-}
      ADMIN_TRUSTED_PROXY_IPS: ${ADMIN_TRUSTED_PROXY_IPS:-}
    volumes:
      - router-data:/data
    ports:
      - "3000:3000"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

volumes:
  router-data: