# Archimedes server — VPS deployment (Docker Compose)
#
# Stack:
#   archimedes-server — application container (public GHCR image; no git clone)
#   postgres          — Postgres 16 in Compose
#   Caddy             — runs on the HOST (not in this file); see Caddyfile
#
# Before deploy: set your public hostname in BACKEND_PUBLIC_URL below and in
# /etc/caddy/Caddyfile. The app listens on 127.0.0.1:8080 only; Caddy fronts HTTPS.

services:
  postgres:
    image: postgres:16-bookworm
    container_name: archimedes_postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: archimedes
      POSTGRES_USER: archimedes
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    secrets:
      - postgres_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U archimedes -d archimedes"]
      interval: 10s
      timeout: 5s
      retries: 5

  archimedes-server:
    image: ghcr.io/everplay-tech/archimedes-server:${ARCH_IMAGE_TAG:-rust-cutover-20260520-ghcr-pipeline}
    container_name: archimedes_server
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DATABASE_URL: postgres://archimedes:${POSTGRES_PASSWORD}@postgres:5432/archimedes
      BIND_ADDR: "0.0.0.0:8080"
      PORT: "8080"
      APPLE_CLIENT_ID: net.llmtech.archimedes
      BACKEND_PUBLIC_URL: https://archimedes.example.com
      ARCHIMEDES_DISPLAY: ":99"
      ARCHIMEDES_FILE_BRIDGE_DIR: /var/lib/archimedes/file-bridge
      TRUST_PROXY: "true"
      JWT_SECRET: ${JWT_SECRET}
      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET}
      RUST_LOG: ${RUST_LOG:-info}
    volumes:
      - file_bridge:/var/lib/archimedes/file-bridge
    ports:
      - "127.0.0.1:8080:8080"

volumes:
  postgres_data:
    name: archimedes_postgres_data
  file_bridge:
    name: archimedes_file_bridge

secrets:
  postgres_password:
    file: ./secrets/postgres_password.txt
