version: '3.8'

# Production deployment for VPS: /opt/webapps/okr/
# DB credentials come from /opt/webapps/webapp-mysql.env (managed on VPS, not in repo).
# App secrets (JWT_SECRET) come from /opt/webapps/okr/.env.app (written by CI deploy step).
# Ports in use on this VPS — DO NOT conflict:
#   3000 = Gitea HTTP, 2222 = Gitea SSH, 8200 = Vault

services:
  okr-backend:
    image: okr-backend:latest
    container_name: okr-backend
    restart: unless-stopped
    env_file:
      - /opt/webapps/webapp-mysql.env   # DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASSWORD, DATABASE_URL
      - /opt/webapps/okr/.env.app        # JWT_SECRET, FRONTEND_ORIGIN
    environment:
      PORT: "3001"
      NODE_ENV: production
    mem_limit: 256m
    cpus: "0.5"
    networks:
      - okr-net
    expose:
      - "3001"

  okr-frontend:
    image: okr-frontend:latest
    container_name: okr-frontend
    restart: unless-stopped
    ports:
      - "80:80"
    mem_limit: 64m
    cpus: "0.25"
    networks:
      - okr-net
    depends_on:
      - okr-backend

networks:
  okr-net:
    driver: bridge