services:
  backend:
    image: ghcr.io/bigbodycobain/shadowbroker-backend:latest
    container_name: shadowbroker-backend
    ports:
      - "${BIND:-127.0.0.1}:8000:8000"
    environment:
      - AIS_API_KEY=${AIS_API_KEY}
      - OPENSKY_CLIENT_ID=${OPENSKY_CLIENT_ID}
      - OPENSKY_CLIENT_SECRET=${OPENSKY_CLIENT_SECRET}
      - LTA_ACCOUNT_KEY=${LTA_ACCOUNT_KEY}
      - ADMIN_KEY=${ADMIN_KEY:-}
      - FINNHUB_API_KEY=${FINNHUB_API_KEY:-}
      # Override allowed CORS origins (comma-separated). Auto-detects LAN IPs if empty.
      - CORS_ORIGINS=${CORS_ORIGINS:-}
      # Default Infonet relay peer so fresh installs can sync immediately.
      - MESH_RELAY_PEERS=${MESH_RELAY_PEERS:-http://cipher0.shadowbroker.info:8000}
      # Shared transport auth for mesh peer push (default matches baked-in testnet secret).
      - MESH_PEER_PUSH_SECRET=${MESH_PEER_PUSH_SECRET:-Mv63UvLfwqOEVWeRBXjA8MtFl2nEkkhUlLYVHiX1Zzo}
    volumes:
      - backend_data:/app/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/health"]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 60s
    deploy:
      resources:
        limits:
          memory: 2G
          cpus: '2'

  frontend:
    image: ghcr.io/bigbodycobain/shadowbroker-frontend:latest
    container_name: shadowbroker-frontend
    ports:
      - "${BIND:-127.0.0.1}:3000:3000"
    environment:
      # Points the Next.js server-side proxy at the backend container via Docker networking.
      # Change this if your backend runs on a different host or port.
      - BACKEND_URL=http://backend:8000
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1'

volumes:
  backend_data: