# Base stack: the parking SERVER (API + SPA) + the VISION (ANPR) service. Branch-aware via
# ${REGISTRY}/${TAG} — a deploy on `dev` pulls :dev, on `main` pulls :main. Use an env
# override file for the environment: docker-compose.dev.yml (build locally, stub recognizer)
# or docker-compose.prod.yml (pull pinned images, fast_alpr). See
# wiki/decisions/container-deployment.md.
#
#   local dev : docker compose -f docker-compose.yml -f docker-compose.dev.yml up --build
#   prod      : REGISTRY=… TAG=main docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d

services:
  server:
    image: ${REGISTRY:-git.infra.msai.al/mca/parking_solution}/parking-server:${TAG:-dev}
    restart: unless-stopped
    environment:
      DATABASE_URL: /data/parking.sqlite
      # Reach the vision service over the private compose network by service name.
      VISION_URL: http://vision:8089
      VISION_ENABLED: ${VISION_ENABLED:-1}
      # JWT signing secret MUST be provided at deploy (no insecure default — see auth.ts).
      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in the env/.env}
      # Dedicated ledger-signing key. Falls back to JWT_SECRET (with a warning) if empty;
      # set a distinct one in prod. See apps/server/.env.example + local-jwt-auth.
      EVENT_SIGNING_KEY: ${EVENT_SIGNING_KEY:-}
      # CRITICAL on the plain-HTTP booth LAN: cookies are Secure (HTTPS-only) by DEFAULT,
      # so without COOKIE_SECURE=0 the auth cookie is never sent over http and operators
      # CANNOT LOG IN. Leave unset only behind TLS. See disk-os-hardening "deploy-time runbook".
      COOKIE_SECURE: ${COOKIE_SECURE:-0}
      # The booth WS live feed checks the browser Origin — must list the address operators
      # actually hit (e.g. http://<booth-ip>:3000), or the live feed is rejected.
      WS_ALLOWED_ORIGINS: ${WS_ALLOWED_ORIGINS:-}
    volumes:
      - parking-data:/data
    depends_on:
      vision:
        condition: service_started
    networks:
      - parking

  vision:
    image: ${REGISTRY:-git.infra.msai.al/mca/parking_solution}/parking-vision:${TAG:-dev}
    restart: unless-stopped
    environment:
      # Engine: stub (no models) by default; prod override sets fast_alpr.
      VISION_RECOGNIZER: ${VISION_RECOGNIZER:-stub}
    networks:
      - parking

volumes:
  parking-data:

networks:
  parking:
    driver: bridge