services:
  vikunja:
    image: vikunja/vikunja:latest
    container_name: vikunja
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    # forgejo.okit.pl is pinned to the npm reverse proxy on PIHA so OIDC
    # discovery resolves over the LAN instead of flaky public DNS, which was
    # causing OIDC discovery to fail.
    extra_hosts:
      - "forgejo.okit.pl:192.168.31.5"
    # Secrets are injected exclusively via env_file (.env, resolved relative to
    # this compose file) so they work regardless of the cwd the deploy runs
    # from — no parse-time ${} interpolation that depends on a .env in cwd.
    env_file:
      - .env
    environment:
      - VIKUNJA_DATABASE_TYPE=postgres
      - VIKUNJA_DATABASE_HOST=db
      - VIKUNJA_DATABASE_PORT=5432
      - VIKUNJA_DATABASE_USER=vikunja
      - VIKUNJA_DATABASE_DATABASE=vikunja
      - VIKUNJA_SERVICE_PUBLICURL=https://vikunja.kapala.org
      - TZ=Europe/Warsaw
    volumes:
      - vikunja_files:/app/vikunja/files
      - ./config.yml:/app/vikunja/config.yml:ro
    ports:
      - "3456:3456"
    # No container healthcheck: the vikunja image has no wget/curl, so any
    # in-container HTTP check is always unhealthy. Health is covered by db's
    # pg_isready + the host-side healthcheck.sh (curl from the host).

  db:
    image: postgres:16-alpine
    container_name: vikunja-db
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - POSTGRES_USER=vikunja
      - POSTGRES_DB=vikunja
      - TZ=Europe/Warsaw
    volumes:
      - vikunja_db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U vikunja -d vikunja"]
      interval: 10s
      timeout: 5s
      retries: 5

# Pinned to the EXISTING named volumes so the live database and uploaded files
# survive cutover. Do not rename these — the data lives here.
volumes:
  vikunja_db:
    name: vikunja_vikunja_db
  vikunja_files:
    name: vikunja_vikunja_files