# Opt-in overlay that enables the admin-only Container Manager.
#
# Preferred:  make docker-build && make docker-up
#   The Makefile applies this overlay, derives DOCKER_GID from the socket, and
#   points DEVPLACE_DATA_DIR at the project's own var/ at its real host path, so
#   everything below resolves with no extra setup.
#
# Manual:  docker compose -f docker-compose.yml -f docker-compose.containers.yml up -d --build
#   Then set DOCKER_GID in .env and, if you want the documented /srv default,
#   create it first:  sudo mkdir -p /srv/devplace-data && sudo chown 1000:1000 /srv/devplace-data
#
# SECURITY: mounting the docker socket grants the app container root on the host.
# Only enable this if you trust your administrators; every build/run/exec is admin-only.
#
# DooD bind-mount gotcha: when the app (inside its container) runs `docker run -v
# <path>:/app`, the docker DAEMON resolves <path> against the HOST filesystem, not the
# app container. So the data dir must be mounted at the SAME absolute path on the host
# and in the app container - that is why DEVPLACE_DATA_DIR and the volume below use one
# identical path on both sides.
#
# Ingress (/p/<slug>) proxies to published container ports on the HOST, so the app
# reaches them via host.docker.internal (mapped to the host gateway below).

services:
  app:
    build:
      args:
        INSTALL_DOCKER_CLI: "true"
    environment:
      DEVPLACE_DATA_DIR: ${DEVPLACE_DATA_DIR:-/srv/devplace-data}
      DEVPLACE_CONTAINER_PROXY_HOST: host.docker.internal
    extra_hosts:
      - "host.docker.internal:host-gateway"
    # The app runs as UID 1000; add the host docker group so it can use the socket.
    # `make docker-up` derives DOCKER_GID from the socket itself; set it in .env
    # only for a manual `docker compose` invocation.
    group_add:
      - "${DOCKER_GID:-999}"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${DEVPLACE_DATA_DIR:-/srv/devplace-data}:${DEVPLACE_DATA_DIR:-/srv/devplace-data}

  # nginx serves /static/uploads/ straight from disk, so it must read the same
  # data dir the app writes. Override the base uploads mount to track the overlay
  # default (compose merges service volumes by container target path).
  nginx:
    volumes:
      - ${DEVPLACE_DATA_DIR:-/srv/devplace-data}/uploads:/data/uploads:ro
