# Production. One service.
#
# The Pireon API is external — a separate deployment on the public internet, not
# part of this stack — so there is nothing here to orchestrate alongside the
# landing, and nothing to wait for on startup. What it does mean is that the
# container needs outbound HTTPS: the page is server-rendered, so every request
# it serves makes ten calls to `landing-api.pireon.dev` from inside the
# container. Behind a restrictive egress policy, that host has to be allowed or
# every page renders as if the API were in maintenance.
#
#   NEXUS_TOKEN=… docker compose build      # the build needs the private registry
#   docker compose up -d
#
# Put a reverse proxy in front for TLS. It should pass the response headers
# through untouched: the app answers 503 with `Retry-After` while the API is in
# maintenance, and 404 for addresses it does not serve.

services:
  landing:
    build:
      context: .
      dockerfile: Dockerfile
      secrets:
        - nexus_token
    image: pireon/landing:latest
    restart: unless-stopped
    # No `ports`. Publishing on the host collides with whatever else is using
    # that number on the machine, and in production the only thing that needs
    # to reach this is the reverse proxy — which does so over the compose
    # network, by service name, on the port below.
    #
    #   proxy_pass http://landing:3000;
    #
    # To reach it from the host anyway (a quick check, or a deployment with no
    # proxy in front), uncomment this and set LANDING_PORT to a free port:
    #
    # ports:
    #   - '${LANDING_PORT:-3000}:3000'
    expose:
      - '3000'
    environment:
      # Where the public API lives. The only setting the app actually reads.
      PIREON_API_URL: ${PIREON_API_URL:-https://landing-api.pireon.dev/api}
      PORT: '3000'
      NODE_ENV: production
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - "fetch('http://127.0.0.1:3000/api/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3
    # The server writes nothing: the build output is all it has, and Nitro only
    # ever needs a scratch directory.
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    logging:
      driver: json-file
      options:
        max-size: '10m'
        max-file: '3'

secrets:
  nexus_token:
    # Read from the environment at build time so the token never lands in a
    # file next to the compose config.
    environment: NEXUS_TOKEN