# Pinned project name — required by global Docker policy so this stack
# can't collide with another /opt/<app>/docker-compose.yml that also
# defaults to the parent directory name.
name: utilisation-dept

services:
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    image: utilisation-dept-backend:local
    restart: unless-stopped
    # Bind to localhost only — Apache fronts the public traffic.
    ports:
      - "127.0.0.1:${UTILISATION_DEPT_PORT:-8200}:8000"
    # Secrets (especially the bcrypt hash with its $ characters) pass through
    # verbatim via env_file, bypassing compose's ${...} interpolation.
    env_file:
      - .env
    environment:
      - APP_BASE_PATH=/utilisation-dept
    volumes:
      # Persist the auth log across container rebuilds — replaces DB audit trail.
      - ./backend/logs:/app/logs
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/api/health', timeout=2).status==200 else 1)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s