docker-compose.prod.yml

# Capital — production overrides. Used WITHOUT the dev override:
#
#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
#
# Caddy is the single entry point; only it binds a host port, and only on the
# Tailscale interface — nothing is exposed to the public internet. Every
# service restarts unless explicitly stopped, so the stack self-recovers on
# reboot (with the Docker daemon enabled at boot).

services:
  postgres:
    ports: !reset []  # internal only — reached over the compose network
    restart: unless-stopped

  engine:
    ports: !reset []
    environment:
      CAPITAL_ENVIRONMENT: production
    restart: unless-stopped

  web:
    ports: !reset []
    restart: unless-stopped

  caddy:
    image: caddy:2-alpine
    container_name: capital-caddy
    depends_on:
      - engine
      - web
    environment:
      CAPITAL_HOSTNAME: ${CAPITAL_HOSTNAME:-localhost}
      # TLS mode: `internal` (Caddy's private CA — Tailscale / local) or an
      # ACME contact email to get a public Let's Encrypt certificate.
      CAPITAL_TLS: ${CAPITAL_TLS:-internal}
    ports:
      # Bind to the interface TAILSCALE_HOST names. It defaults to localhost
      # so a misconfigured deploy is never publicly reachable; set it to the
      # Tailscale IP for a tailnet deploy, or 0.0.0.0 for a public cloud VM.
      - "${TAILSCALE_HOST:-127.0.0.1}:80:80"
      - "${TAILSCALE_HOST:-127.0.0.1}:443:443"
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    restart: unless-stopped

volumes:
  caddy_data:
  caddy_config: