services:
  workspace:
    build: .
    image: narl-workspace:latest
    restart: unless-stopped
    env_file:
      - .env
    environment:
      # These win over anything in .env: inside the container the app must
      # listen on all interfaces and keep its state on the volume.
      WORKSPACE_BIND: 0.0.0.0:4242
      WORKSPACE_DATA_DIR: /data
    volumes:
      # Named for what it held when it was made. Renaming it would mean moving
      # the database into a new volume by hand, which is no kind of upgrade.
      - diary-data:/data
    networks:
      - internal_net
    ports:
      # Localhost only. Drop this in the override when a reverse proxy
      # reaches the container over its own network instead.
      - "127.0.0.1:4242:4242"
      # Only listens if WORKSPACE_SFTP_BIND is set in .env (see there);
      # otherwise this maps to a port nothing is bound on. Traefik is
      # HTTP-only, so a deployment behind it must publish this port itself
      # rather than relying on the reverse proxy — see compose.override.yml.example.
      # - "127.0.0.1:2222:2222"
    healthcheck:
      # No extra tooling in the image, so probe the port with bash directly.
      test: ["CMD", "bash", "-c", "exec 3<>/dev/tcp/127.0.0.1/4242"]
      interval: 30s
      timeout: 3s
      start_period: 5s
      retries: 3

volumes:
  diary-data:

networks:
  internal_net: