version: '3.9'

services:
  collabfinder:
    build: .
    container_name: collabfinder
    restart: unless-stopped
    ports:
      - "1800:1800"
    env_file:
      - .env
    volumes:
      # Runtime data (persisted locally on the Docker host; written by non-root container user)
      - ./logs:/app/logs
      - ./storage:/app/storage

      # Rotating Webex Service App token (critical for backend operations + auto-refresh writes)
      # - Keep this file ONLY locally (it is .gitignored and .dockerignored).
      # - Provide a valid bootstrap copy on the HOST before first run.
      # - App will read + write (refresh) it via the bind mount.
      # - On some hosts you may need: chmod 666 config/webex-service-tokens.json (for non-root writes)
      # - All other config via .env (loaded by env_file).
      - ./config/webex-service-tokens.json:/app/config/webex-service-tokens.json

      # Required local files for full functionality (provide in your ./storage/ on host):
      # - storage/aeoroots.cer  (for /provision-vc certificate flows)
      #
      # Legacy config/config.json has been removed. All configuration is now via .env variables.
    networks:
      - collabnet

  # Optional: Add Redis later if you want better caching
  # redis:
  #   image: redis:7-alpine
  #   container_name: collabfinder-redis
  #   restart: unless-stopped
  #   networks:
  #     - collabnet

networks:
  collabnet:
    driver: bridge