# test-app-stack — frontend (TanStack Start) + backend (ElysiaJS/Bun)
# Designed to plug into the EXISTING Traefik instance already running on the
# VPS (the one from forgejo-stack). It therefore reuses the external `web`
# network and the `le` Let's Encrypt cert resolver. No Traefik service is
# defined here on purpose.

services:
  backend:
    build: ./backend
    container_name: test-app-backend
    restart: unless-stopped
    environment:
      - NODE_ENV=production
      - PORT=3000
      - FRONTEND_ORIGIN=${FRONTEND_ORIGIN:-https://test-app.emmanuelariasa.com}
    networks:
      - web
      - app-internal
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      - "traefik.http.routers.testapp-api.rule=Host(`${API_DOMAIN:-test-app-api.emmanuelariasa.com}`)"
      - "traefik.http.routers.testapp-api.entrypoints=websecure"
      - "traefik.http.routers.testapp-api.tls.certresolver=le"
      - "traefik.http.services.testapp-api.loadbalancer.server.port=3000"

  frontend:
    build:
      context: ./frontend
      args:
        # Baked into the client bundle at build time.
        VITE_API_URL: "https://${API_DOMAIN:-test-app-api.emmanuelariasa.com}"
    container_name: test-app-frontend
    restart: unless-stopped
    depends_on:
      - backend
    environment:
      - NODE_ENV=production
      - PORT=3000
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      - "traefik.http.routers.testapp.rule=Host(`${APP_DOMAIN:-test-app.emmanuelariasa.com}`)"
      - "traefik.http.routers.testapp.entrypoints=websecure"
      - "traefik.http.routers.testapp.tls.certresolver=le"
      - "traefik.http.services.testapp.loadbalancer.server.port=3000"

networks:
  # Shared with Traefik + forgejo. Created already by the forgejo stack.
  web:
    external: true
  # Private network for any future backend<->db traffic; not exposed.
  app-internal:
    driver: bridge