docker-compose.yml

name: SWGoHBotSite

# MongoDB is external - it runs on the host and is shared with the bot, so it is not managed here.
# MONGODB_URI in .env must use host.docker.internal, not localhost, which inside a container
# resolves to the container itself.
#
# Host nginx terminates TLS for swgohbot.com and proxies to http://localhost:3300, so the port
# below is published on loopback only and never reaches the public interface.

services:
  website:
    image: ghcr.io/jmiln/swgohbotsite:${IMAGE_TAG:-latest}
    # `build:` is for local iteration only. Anything deployed is built and published by CI.
    build:
      context: .
      args:
        APP_VERSION: ${APP_VERSION:-dev}
        VCS_REF: ${VCS_REF:-unknown}
    container_name: swgohbotsite
    restart: unless-stopped
    env_file: .env
    init: true
    # server.ts arms a 10s force-exit timer, so the container must outlive it or Docker will
    # SIGKILL mid-teardown and hide the timeout.
    stop_grace_period: 20s
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      # Overrides whatever .env holds, so the in-container paths cannot drift from the mounts below.
      BOT_SCHEMAS_PATH: /app/bot/schemas
      BOT_HELP_PATH: /app/bot/help.json
      EXTRAS_PATHS: ""
    volumes:
      # Under /app so the schemas resolve zod from the site's node_modules.
      - ${BOT_SCHEMAS_PATH:?set BOT_SCHEMAS_PATH in .env}:/app/bot/schemas:ro
      - ${BOT_HELP_PATH:?set BOT_HELP_PATH in .env}:/app/bot/help.json:ro
    ports:
      # HOST_PORT moves only the published port, e.g. to run a second instance alongside.
      - "127.0.0.1:${HOST_PORT:-${PORT:-3300}}:${PORT:-3300}"
    networks:
      - swgoh
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - "no-new-privileges:true"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

# Owned by the separate `fake-help` compose project, which runs comlink, nginx and swgoh-ae2.
# That project must be up first; compose will neither create nor destroy this network.
networks:
  swgoh:
    name: fake-help_default
    external: true