services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      secrets:
        - NODE_AUTH_TOKEN
    restart: unless-stopped
    # Fileless deploy (DEPLOY#<stage>.noEnvFile: true): no .env exists. tenant-deploy.yml streams the
    # stage-scoped vault values over SSH into a tmpfs (/dev/shm) runtime env, and the box injects them
    # into every service labelled mmi.runtime-env. Never add env_file.
    labels:
      mmi.runtime-env: "true"
    environment:
      NODE_ENV: production
      MMI_STAGE: ${MMI_STAGE:-dev}
      MMI_PORT: ${MMI_PORT:-3000}
      PORT: ${PORT:-3000}
      MMI_EDGE_DOMAIN: ${MMI_EDGE_DOMAIN:-}
    ports:
      # Loopback only: the box Caddy is the one public door (TLS), never the bare port.
      - "127.0.0.1:${MMI_PORT:-3000}:${PORT:-3000}"

secrets:
  NODE_AUTH_TOKEN:
    environment: NODE_AUTH_TOKEN