services:
  overlord-server:
    image: ${DOCKER_IMAGE:-ghcr.io/vxaboveground/overlord:latest}
    container_name: overlord-server
    ports:
      - "${PORT:-5173}:5173"
    environment:
      PORT: ${PORT:-5173}
      HOST: ${HOST:-0.0.0.0}
      # Optional: set an explicit initial admin account. If OVERLORD_PASS is empty,
      # the server generates one-time bootstrap secrets and stores them in /app/data/save.json.
      OVERLORD_USER: ${OVERLORD_USER:-admin}
      OVERLORD_PASS: ${OVERLORD_PASS:-}
      # Optional overrides. If empty, generated and persisted to /app/data/save.json.
      JWT_SECRET: ${JWT_SECRET:-}
      OVERLORD_AGENT_TOKEN: ${OVERLORD_AGENT_TOKEN:-}
      NODE_ENV: ${NODE_ENV:-production}
      OVERLORD_TLS_CERT: ${OVERLORD_TLS_CERT:-/app/certs/server.crt}
      OVERLORD_TLS_KEY: ${OVERLORD_TLS_KEY:-/app/certs/server.key}
      OVERLORD_TLS_CA: ${OVERLORD_TLS_CA:-}
      # Optional certbot integration (used only when NODE_ENV=production)
      OVERLORD_TLS_CERTBOT_ENABLED: ${OVERLORD_TLS_CERTBOT_ENABLED:-false}
      OVERLORD_TLS_CERTBOT_LIVE_PATH: ${OVERLORD_TLS_CERTBOT_LIVE_PATH:-/etc/letsencrypt/live}
      OVERLORD_TLS_CERTBOT_DOMAIN: ${OVERLORD_TLS_CERTBOT_DOMAIN:-}
      OVERLORD_TLS_CERTBOT_CERT_FILE: ${OVERLORD_TLS_CERTBOT_CERT_FILE:-fullchain.pem}
      OVERLORD_TLS_CERTBOT_KEY_FILE: ${OVERLORD_TLS_CERTBOT_KEY_FILE:-privkey.pem}
      OVERLORD_TLS_CERTBOT_CA_FILE: ${OVERLORD_TLS_CERTBOT_CA_FILE:-chain.pem}
    volumes:
      - overlord-data:/app/data
      - overlord-certs:/app/certs
      # Uncomment to mount host certbot certs read-only
      # - /etc/letsencrypt:/etc/letsencrypt:ro
      # Uncomment to use a static config file instead of env vars
      # - ./Overlord-Server/config.json:/app/config.json:ro
    restart: unless-stopped
    init: true
    security_opt:
      - no-new-privileges:true
    networks:
      - overlord-network
    healthcheck:
      test: ["CMD", "curl", "-f", "-k", "https://localhost:5173/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

networks:
  overlord-network:
    driver: bridge

volumes:
  overlord-data:
  overlord-certs: