# PROD override: pull pinned registry images (no local build), restart always, real
# recognizer, and a CADDY reverse proxy in front so operators reach the booth on a clean
# port-80 URL (no :3000) — and a path to real TLS later. Server + vision stay INTERNAL
# (only Caddy publishes a port). Use with the base file and pin TAG to the branch you deploy:
#   REGISTRY=git.infra.msai.al/mca/parking_solution TAG=main \
#     docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
# See wiki/decisions/container-deployment.md.

services:
  # Reverse proxy: :80 → server:3000 (WebSocket /api/ws upgrades pass through natively).
  # Caddy is a single static binary with a one-line proxy config; swapping http:// for the
  # site's real hostname later enables automatic HTTPS. The booth is reached at
  # http://<name-or-ip>/ (the name set via hosts/DNS on-site — NOT baked into any image).
  proxy:
    image: caddy:2-alpine
    restart: always
    ports:
      - "80:80"
      # - "443:443"   # uncomment when moving to TLS (and set a real hostname in Caddyfile)
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
    depends_on:
      - server
    networks:
      - parking
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  server:
    restart: always
    # No published port — only the proxy reaches the server, over the private network.
    expose:
      - "3000"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  vision:
    restart: always
    # The real ANPR engine. The image baked the model weights at build (offline-first).
    environment:
      VISION_RECOGNIZER: fast_alpr
    # No published ports — vision is reached only by the server over the private network.
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  caddy-data:
  caddy-config: