services:
  makearmy-app:
    build:
      context: ./app
      dockerfile: Dockerfile
    container_name: makearmy-app
    restart: unless-stopped

    # Load secrets/config without baking into image
    env_file:
      - /var/www/lasereverything.net.db/app/.env.local

    # Run as non-root
    user: "1000:1000"

    environment:
      - NODE_ENV=production
      - NEXT_PUBLIC_API_BASE_URL=https://forms.lasereverything.net
      - NEXT_PUBLIC_FILE_API_BASE_URL=https://db.lasereverything.net
      - NEXT_PUBLIC_MAIN_MENU_URL=https://db.lasereverything.net
      - BGREMOVER_BASE_URL=http://bgbye:7001
      - BG_BYE_UPSTREAM=http://bgbye:7001/remove_background/
      - FILES_ROOT=/app/files
      - HOME=/tmp
      - NEXT_TELEMETRY_DISABLED=1

    # Harden
    read_only: true
    tmpfs:
      - /tmp:noexec,nosuid,nodev,size=256m,mode=1777
      - /run:noexec,nosuid,nodev,size=64m,mode=755
      - /app/.next/cache:noexec,nosuid,nodev,size=512m,mode=1777
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

    # Only mount what must be writable
    volumes:
      - /var/www/lasereverything.net.db/app/files:/app/files:rw

    ports:
      - "127.0.0.1:3005:3000"

    networks:
      - makearmy_net

  bgbye:
    build:
      context: ./bgbye
      dockerfile: Dockerfile.gpu
    container_name: bgbye
    restart: unless-stopped
    runtime: nvidia

    environment:
      - NVIDIA_VISIBLE_DEVICES=all
      - NVIDIA_DRIVER_CAPABILITIES=compute,utility
      - OMP_NUM_THREADS=1
      - PYTHONWARNINGS=ignore

    ports:
      - "127.0.0.1:7001:7001"

    volumes:
      # cache directory
      - ./bgbye/.cache:/root/.cache

      # model caches (prevents re-downloading)
      - ./bgbye/.u2net:/root/.u2net
      - ./bgbye/.ormbg:/root/.ormbg

    networks:
      - makearmy_net

networks:
  makearmy_net:
    external: true