name: whatido

services:
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: whereldo
      POSTGRES_USER: app
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      TZ: Europe/Moscow
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U app -d whereldo"]
      interval: 2s
      timeout: 3s
      retries: 10

  app:
    build: .
    expose:
      - "3003"
      - "3443"
    ports:
      - "3003:3003"
      - "3443:3443"
    environment:
      DATABASE_URL: postgres://app:${DB_PASSWORD}@db:5432/whereldo
      ADMIN_PASSWORD: ${ADMIN_PASSWORD}
      NODE_ENV: production
      TZ: Europe/Moscow
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - ./uploads:/app/uploads

  # Публикация через Tailscale (Serve / Funnel) без проброса портов.
  # Приложение доступно по https://whatido.<tailnet>.ts.net
  tailscale:
    image: tailscale/tailscale:latest
    hostname: whatido
    restart: unless-stopped
    network_mode: host
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      SSL_CERT_FILE: /etc/tailscale/app-certs/cert.pem
    volumes:
      - /var/lib/tailscale:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
      - /lib/modules:/lib/modules:ro
      - ./certs:/etc/tailscale/app-certs:ro
      - ./start-tailscale.sh:/start-tailscale.sh:ro
    command: ["/bin/sh", "/start-tailscale.sh"]
    depends_on:
      - app

volumes:
  pgdata: