# STCourses with Docker Compose. Project name "stc", so containers are stc-app-1 and stc-postgres-1.
#
#   SQLite (default):   STC_SECRET=... docker compose up -d
#   Postgres:           STC_SECRET=... STC_DATABASE_URL=postgres://stc:stc@postgres:5432/stc \
#                         docker compose --profile postgres up -d
#
# Course repos go in ./courses (or set STC_COURSES_HOST); files to import go in ./import-inbox (or STC_IMPORT_HOST).
# Both are mounted read-only: originals are never changed. See docs/operations.md.
name: stc

services:
  app:
    build: .
    image: stc-app
    restart: unless-stopped
    ports:
      - "${STC_HOST_PORT:-3000}:3000"
    environment:
      STC_SECRET: ${STC_SECRET:?set STC_SECRET to a long random string}
      STC_PUBLIC_URL: ${STC_PUBLIC_URL:-http://localhost:3000}
      STC_DATABASE_URL: ${STC_DATABASE_URL:-sqlite:///data/stcourses.db}
      STC_UPLOAD_MAX_MB: ${STC_UPLOAD_MAX_MB:-100}
      STC_AI_ALLOWED_BASE_URLS: ${STC_AI_ALLOWED_BASE_URLS:-}
      STC_TRANSCRIBE_URL: ${STC_TRANSCRIBE_URL:-}
      STC_TRANSCRIBE_KEY: ${STC_TRANSCRIBE_KEY:-}
      STC_TRANSCRIBE_MODEL: ${STC_TRANSCRIBE_MODEL:-}
      STC_ALLOWED_ORIGINS: ${STC_ALLOWED_ORIGINS:-}
      # Sign-in providers (unset ones stay off). Social: STC_AUTH_<GITHUB|GOOGLE|MICROSOFT|GITLAB|DISCORD>_ID/_SECRET.
      STC_AUTH_GITHUB_ID: ${STC_AUTH_GITHUB_ID:-}
      STC_AUTH_GITHUB_SECRET: ${STC_AUTH_GITHUB_SECRET:-}
      STC_AUTH_GOOGLE_ID: ${STC_AUTH_GOOGLE_ID:-}
      STC_AUTH_GOOGLE_SECRET: ${STC_AUTH_GOOGLE_SECRET:-}
      STC_AUTH_MICROSOFT_ID: ${STC_AUTH_MICROSOFT_ID:-}
      STC_AUTH_MICROSOFT_SECRET: ${STC_AUTH_MICROSOFT_SECRET:-}
      STC_AUTH_GITLAB_ID: ${STC_AUTH_GITLAB_ID:-}
      STC_AUTH_GITLAB_SECRET: ${STC_AUTH_GITLAB_SECRET:-}
      STC_AUTH_DISCORD_ID: ${STC_AUTH_DISCORD_ID:-}
      STC_AUTH_DISCORD_SECRET: ${STC_AUTH_DISCORD_SECRET:-}
      STC_AUTH_OIDC_ISSUER: ${STC_AUTH_OIDC_ISSUER:-}
      STC_AUTH_OIDC_ID: ${STC_AUTH_OIDC_ID:-}
      STC_AUTH_OIDC_SECRET: ${STC_AUTH_OIDC_SECRET:-}
      STC_AUTH_OIDC_NAME: ${STC_AUTH_OIDC_NAME:-}
      STC_AUTH_OIDC_SCOPES: ${STC_AUTH_OIDC_SCOPES:-}
      STC_AUTH_OIDC_DISCOVERY_URL: ${STC_AUTH_OIDC_DISCOVERY_URL:-}
      STC_AUTH_GROUPS_CLAIM: ${STC_AUTH_GROUPS_CLAIM:-}
    depends_on:
      postgres:
        condition: service_healthy
        required: false   # only with --profile postgres
    volumes:
      - stc-data:/data
      - ${STC_COURSES_HOST:-./courses}:/courses:ro
      - ${STC_IMPORT_HOST:-./import-inbox}:/import:ro

  postgres:
    image: postgres:17
    profiles: ["postgres"]
    restart: unless-stopped
    environment:
      POSTGRES_USER: stc
      POSTGRES_PASSWORD: ${STC_PG_PASSWORD:-stc}
      POSTGRES_DB: stc
    volumes:
      - stc-pg:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U stc -d stc"]
      interval: 5s
      retries: 20

volumes:
  stc-data:
  stc-pg: