# Bike-Tinder stack — deck app + Tailscale sidecar.
#
# Deployed on Rotarran at /var/mnt/DATA/podman-stacks/bike-tinder/ (a checkout
# of the `release` branch). Run via the user unit podman-stack-bike-tinder.service
# (Delegate=yes) or manually:
#   podman-compose -f deploy/docker-compose.yml --env-file .env up -d
#
# Networking:
#   - app: published on 127.0.0.1:9453 only — Hermes cron triggers (import /
#     agent read) and local debugging. The LAN sees nothing.
#   - tailscale (userspace mode, no tun/caps): joins the tailnet as `biketinder`
#     and serves https://biketinder.tailf35a34.ts.net -> http://app:8000 (443).
# Secrets: TS_AUTHKEY + OPENROUTER_API_KEY come from the stack-local .env
# (never committed). Before the authkey is placed, the sidecar simply reports
# "no authkey" and exits — the app runs fine on its own.

x-logging: &default-logging
  driver: "json-file"
  options:
    max-size: "50m"
    max-file: "5"
    compress: "true"

services:
  app:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
    image: localhost/bike-tinder:latest
    container_name: bike-tinder-app
    restart: unless-stopped
    environment:
      - TZ=America/Halifax
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
    volumes:
      - /var/mnt/DATA/podman-stacks/bike-tinder/data:/data
      - /var/home/admin/.hermes/scripts/motorcycle-hunt.d:/state:ro,z
    ports:
      - "127.0.0.1:9453:8000"
    stop_grace_period: 15s
    security_opt:
      - no-new-privileges:true
    logging:
      <<: *default-logging

  tailscale:
    image: docker.io/tailscale/tailscale:latest
    container_name: bike-tinder-ts
    hostname: biketinder
    restart: unless-stopped
    depends_on:
      - app
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY:-}
      - TS_HOSTNAME=biketinder
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json
      - TS_USERSPACE=true
      - TZ=America/Halifax
    volumes:
      - /var/mnt/DATA/podman-stacks/bike-tinder/tailscale-state:/var/lib/tailscale
      - /var/mnt/DATA/podman-stacks/bike-tinder/deploy/tailscale:/config:ro
    logging:
      <<: *default-logging