services:
  server:
    build: ./server
    environment:
      # Set MYKINDLEBOX_PASSWORD (e.g. in a .env file next to this compose file)
      # to require a login. If left empty, auth is DISABLED and the app is open
      # to anyone who can reach it — only acceptable on a fully trusted network.
      AUTH_PASSWORD: ${MYKINDLEBOX_PASSWORD:-}
      DATA_DIR: /app/data
    volumes:
      - server-data:/app/data
    restart: unless-stopped
    # No published port: the server is only reached through the client's nginx
    # reverse proxy on the internal compose network. Add a `ports` mapping here
    # if you want to hit the API directly for debugging.

  client:
    build: ./client
    ports:
      - "8080:80"
    depends_on:
      - server
    restart: unless-stopped

volumes:
  server-data: