services:
  server:
    build: ./server
    environment:
      # Set MYKINDLEBOX_PASSWORD (e.g. in a .env file next to this compose file)
      # to require a login. If left empty, auth is DISABLED and the app is open
      # to anyone who can reach it — only acceptable on a fully trusted network.
      AUTH_PASSWORD: ${MYKINDLEBOX_PASSWORD:-}
      DATA_DIR: /app/data
    volumes:
      - server-data:/app/data
    restart: unless-stopped
    # busybox wget ships in node:20-alpine, so no extra package is needed.
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3001/health"]
      interval: 30s
      timeout: 3s
      start_period: 15s
      retries: 3
    # No published port: the server is only reached through the client's nginx
    # reverse proxy on the internal compose network. Add a `ports` mapping here
    # if you want to hit the API directly for debugging.

  client:
    build: ./client
    ports:
      # Host port is configurable: set MYKINDLEBOX_PORT (e.g. in the same .env
      # as MYKINDLEBOX_PASSWORD) to serve on a different port. Defaults to 8080.
      - "${MYKINDLEBOX_PORT:-8080}:80"
    # Wait for the API to answer /health before starting nginx, so the first
    # page load after `docker compose up` can't hit a 502 from a still-booting
    # server.
    depends_on:
      server:
        condition: service_healthy
    restart: unless-stopped

volumes:
  server-data: