services:
  app:
    image: ${NEURALHUNT_SERVER_IMAGE:-neuralhunt-server:local}
    build:
      context: .
      dockerfile: Dockerfile.server
    env_file:
      - path: .env
        required: false
    environment:
      SQLITE_PATH: /data/neuralhunt.db
      ARTIFACT_DIR: /data/artifacts
      # Durable positive-tip credit outbox is delivered to the Customer Service
      # only when the hosted profile is running.
      CUSTOMER_SERVICE_INTERNAL_URL: http://customer-service:8092
    ports:
      - "8080:8080"
      # Main-game admin/control plane. Route this only through VPN/private proxy.
      - "127.0.0.1:8081:8081"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - neuralhunt_data:/data
    networks:
      - neuralhunt_backend
    restart: unless-stopped

  # Optional hosted commercial control plane. It is intentionally a separate
  # image/process/database from the game server. Port 8090 is the customer
  # portal; 8091 is private admin; 8092 is Docker-network-only registration.
  customer-service:
    profiles: ["hosted"]
    image: ${NEURALHUNT_CUSTOMER_IMAGE:-neuralhunt-customer-service:local}
    build:
      context: .
      dockerfile: Dockerfile.customer-service
    env_file:
      - path: .env
        required: false
    environment:
      CUSTOMER_SQLITE_PATH: /customer-data/customer-service.db
      CS_GAME_PUBLIC_URL: http://app:8080
      CS_GAME_ADMIN_URL: http://app:8081
      # The worker is a genuinely separate image now. Point this at any
      # compatible prebuilt/published worker image. The Customer Service can
      # auto-pull it when it is not present on the Docker host.
      CS_WORKER_IMAGE: ${CS_WORKER_IMAGE:-neuralhunt-worker:local}
      CS_WORKER_AUTO_PULL: ${CS_WORKER_AUTO_PULL:-true}
      CS_WORKER_ENTRYPOINT: ${CS_WORKER_ENTRYPOINT:-}
      CS_WORKER_NETWORK: neuralhunt_backend
      CS_WORKER_REGISTER_URL: http://customer-service:8092/internal/workers/register
      DOCKER_HOST: unix:///var/run/docker.sock
    ports:
      - "8090:8090"
      - "127.0.0.1:8091:8091"
    expose:
      - "8092"
    # Direct docker.sock access is powerful. For production, prefer a tightly
    # scoped Docker Socket Proxy and point DOCKER_HOST at that proxy instead.
    user: "0:0"
    volumes:
      - customer_data:/customer-data
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - neuralhunt_backend
    depends_on:
      - app
    restart: unless-stopped

  # Build-only helper. `docker compose --profile images build worker-image`
  # creates/tags the third image without starting a hunting agent.
  worker-image:
    profiles: ["images"]
    image: ${CS_WORKER_IMAGE:-neuralhunt-worker:local}
    build:
      context: .
      dockerfile: Dockerfile.worker
    entrypoint: ["/bin/true"]
    restart: "no"

  service-controller-image:
    profiles: ["images"]
    image: ${NEURALHUNT_SERVICE_CONTROLLER_IMAGE:-neuralhunt-service-controller:local}
    build:
      context: .
      dockerfile: Dockerfile.service-controller
    entrypoint: ["/bin/true"]
    restart: "no"

volumes:
  neuralhunt_data: {}
  customer_data: {}

networks:
  neuralhunt_backend:
    name: neuralhunt_backend