# Development overlay: mounted source, hot reload, exposed database port, plain HTTP.
#
# DRY_RUN defaults to true here and the Makefile passes --env-file .env.dev. A local run
# renders and logs email but never sends it, so a laptop pointed at real data cannot mail
# real guests (task 8.8).

services:
  postgres:
    ports:
      - "5432:5432" # published so a GUI client can connect; prod does not do this

  # `--env-file` only feeds ${...} interpolation in the compose file; it does NOT put
  # variables inside containers. `env_file:` is what actually injects them, so without it
  # the app silently runs on its built-in defaults.
  api:
    build:
      # The only stage with pytest, mypy and ruff in it — `make test` and `make lint` run
      # inside this container. The production image deliberately cannot run them.
      target: dev
    env_file:
      - .env.dev
    environment:
      ENVIRONMENT: dev
      DRY_RUN: "true"
      LOG_LEVEL: DEBUG
    volumes:
      - ./api:/app
    command:
      ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]

  worker:
    build:
      target: dev
    env_file:
      - .env.dev
    environment:
      ENVIRONMENT: dev
      DRY_RUN: "true"
      LOG_LEVEL: DEBUG
    volumes:
      - ./api:/app

  web:
    build:
      target: deps # stop before the production build; dev runs `next dev`
    # Deliberately not `env_file` — the frontend has no business holding the session
    # secret or provider keys. It gets only what it renders with.
    #
    # None of these carry the NEXT_PUBLIC_ prefix on purpose: Next inlines those at build
    # time, which silently ignores whatever is set here in the production image. They are
    # read at request time by `lib/public-config.ts` and passed down as props instead.
    environment:
      NODE_ENV: development
      NEXT_TELEMETRY_DISABLED: "1"
      INTERNAL_API_URL: http://api:8000
      # Windows bind mounts do not deliver inotify events into a Linux container, so
      # without polling `next dev` never notices an edit and hot reload silently does
      # nothing — you change a component, reload, and see the old one (task 1.6).
      WATCHPACK_POLLING: "true"
      TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY:-1x00000000000000000000AA}
      # Only `metadataBase` uses this — preview URLs arrive from the API already absolute.
      APP_BASE_URL: ${APP_BASE_URL:-http://localhost}
      # Public OAuth client id only — never the secret, which stays with the API.
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      # Renders the dev sign-in box. The API refuses it anyway unless AUTH_DEV_BYPASS is
      # set there too, so this flag alone cannot let anyone in.
      AUTH_DEV_BYPASS: ${AUTH_DEV_BYPASS:-false}
    volumes:
      - ./web:/app
      - /app/node_modules
    command: ["npm", "run", "dev"]

  caddy:
    ports:
      - "80:80"
    volumes:
      - ./caddy/Caddyfile.dev:/etc/caddy/Caddyfile:ro
