services:
  overlord-server:
    image: ghcr.io/vxaboveground/overlord:latest
    build:
      context: .
      dockerfile: Dockerfile
      cache_from:
        - type=local,src=.docker-cache/buildx
      cache_to:
        - type=local,dest=.docker-cache/buildx,mode=max
    container_name: overlord-server
    ports:
      - "5173:5173"
    environment:
      # Optional username for first admin user
      - OVERLORD_USER=admin
      # Leave these empty to auto-generate and persist to /app/data/save.json
      - OVERLORD_PASS=
      - JWT_SECRET=
      - OVERLORD_AGENT_TOKEN=
      # Server settings
      - PORT=5173
      - HOST=0.0.0.0
      # TLS paths (self-signed is auto-generated if not present)
      - OVERLORD_TLS_CERT=/app/certs/server.crt
      - OVERLORD_TLS_KEY=/app/certs/server.key
      - OVERLORD_TLS_CA=
      # Set true only behind a trusted reverse proxy that terminates TLS (for example Render).
      # Default false keeps current behavior: Overlord terminates TLS in-process.
      - OVERLORD_TLS_OFFLOAD=false
      # Optional certbot integration (used only when NODE_ENV=production)
      - OVERLORD_TLS_CERTBOT_ENABLED=false
      - OVERLORD_TLS_CERTBOT_LIVE_PATH=/etc/letsencrypt/live
      - OVERLORD_TLS_CERTBOT_DOMAIN=
      - OVERLORD_TLS_CERTBOT_CERT_FILE=fullchain.pem
      - OVERLORD_TLS_CERTBOT_KEY_FILE=privkey.pem
      - OVERLORD_TLS_CERTBOT_CA_FILE=chain.pem
      - OVERLORD_CLIENT_BUILD_CACHE_DIR=/app/client-build-cache
      - OVERLORD_FILE_UPLOAD_INTENT_TTL_MS=1800000
      - OVERLORD_FILE_UPLOAD_PULL_TTL_MS=1800000
    volumes:
      - overlord-data:/app/data
      - overlord-certs:/app/certs
      - overlord-client-build-cache:/app/client-build-cache
      # Uncomment to mount host certbot certs read-only
      # - /etc/letsencrypt:/etc/letsencrypt:ro
      # Uncomment to use a static config file instead of env vars
      # - ./Overlord-Server/config.json:/app/config.json:ro
    restart: unless-stopped
    networks:
      - overlord-network
    healthcheck:
      test: ["CMD", "curl", "-f", "-k", "https://localhost:5173/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

networks:
  overlord-network:
    driver: bridge

volumes:
  overlord-data:
  overlord-certs:
  overlord-client-build-cache: