services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      # Build-time secret opt-in:
      # secrets:
      #   - NODE_AUTH_TOKEN
    restart: unless-stopped
    # Fileless deploy (DEPLOY#<stage>.noEnvFile: true): no .env exists. tenant-deploy.yml streams the
    # stage-scoped vault values over SSH into a tmpfs (/dev/shm) runtime env, and the box injects them
    # into every service labelled mmi.runtime-env. Never add env_file.
    labels:
      mmi.runtime-env: "true"
    environment:
      NODE_ENV: production
      MMI_STAGE: ${MMI_STAGE:-dev}
      MMI_PORT: ${MMI_PORT:-3000}
      PORT: ${PORT:-3000}
      MMI_EDGE_DOMAIN: ${MMI_EDGE_DOMAIN:-}
    ports:
      # Loopback only: the box Caddy is the one public door (TLS), never the bare port.
      - "127.0.0.1:${MMI_PORT:-3000}:${PORT:-3000}"

# Build-time secret opt-in. Requires registry META:
# requiredBuildSecrets: ["NODE_AUTH_TOKEN=@github-packages-token"]
# secrets:
#   NODE_AUTH_TOKEN:
#     environment: NODE_AUTH_TOKEN