services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      # Build-time secret opt-in:
      # secrets:
      #   - NODE_AUTH_TOKEN
    restart: unless-stopped
    # The box control document writes registry coords + stage-scoped SSM secret values into the
    # release ./.env before `docker compose up`; env_file is what delivers them into the container.
    env_file: .env
    environment:
      NODE_ENV: production
      MMI_STAGE: ${MMI_STAGE:-dev}
      MMI_PORT: ${MMI_PORT:-3000}
      PORT: ${PORT:-3000}
      MMI_EDGE_DOMAIN: ${MMI_EDGE_DOMAIN:-}
    ports:
      - "${MMI_PORT:-3000}:${PORT:-3000}"

# Build-time secret opt-in. Requires registry META:
# requiredBuildSecrets: ["NODE_AUTH_TOKEN=@github-packages-token"]
# secrets:
#   NODE_AUTH_TOKEN:
#     environment: NODE_AUTH_TOKEN