# Deploy: board-viewer
# Target: /opt/stacks/board-viewer/docker-compose.yml on VDS
#
# Prereqs:
#   1. DNS A-record: board.kzntsv.site → VDS IP
#   2. Traefik network `proxy` exists (it does — used by Gitea et al)
#   3. ./auth.toml contains gitea_url, gitea_token, board_viewer_repos
#   4. ./.htpasswd built via:  htpasswd -nbB <user> <pass> >> ./.htpasswd
#
# Apply:
#   cd /opt/stacks/board-viewer && docker compose up -d
#
# First build is local: see deploy/README.md for image build & push to
# registry.kzntsv.site, or build on host via `docker compose build`.

services:
  build:
    image: registry.kzntsv.site/board-viewer-build:latest
    container_name: board-viewer-build
    restart: unless-stopped
    environment:
      BOARD_CONFIG_PATH: /etc/board-viewer/auth.toml
      BOARD_DIST_DIR: /output
      BOARD_TICK_SEC: "300"
    volumes:
      - ./auth.toml:/etc/board-viewer/auth.toml:ro
      - dist:/output
    networks:
      - proxy

  web:
    image: nginx:alpine
    container_name: board-viewer-web
    restart: unless-stopped
    env_file:
      - .env
    volumes:
      - dist:/usr/share/nginx/html:ro
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
    networks:
      - proxy
    depends_on:
      - build
    labels:
      traefik.enable: "true"
      traefik.docker.network: "proxy"

      traefik.http.routers.board-viewer.entrypoints: "websecure"
      traefik.http.routers.board-viewer.rule: "Host(`board.kzntsv.site`)"
      traefik.http.routers.board-viewer.tls.certresolver: "letsEncrypt"
      traefik.http.routers.board-viewer.middlewares: "board-viewer-auth"

      # Basic-auth users live in .env as BOARD_VIEWER_USERS
      # (one or more `user:bcrypt-hash` entries, comma-separated, with $$ for $).
      # See deploy/README.md "One-time setup" step 3.
      traefik.http.middlewares.board-viewer-auth.basicauth.users: "${BOARD_VIEWER_USERS}"

      traefik.http.services.board-viewer.loadbalancer.server.port: "80"

volumes:
  dist:

networks:
  proxy:
    external: true