services:
  ksan-dev:
    # Built and pushed by CI; deployed by tag, never by :latest, so a rollback
    # is a re-run of `up -d` with an older tag instead of a rebuild.
    image: ${IMAGE_NAME:-git.ksan.dev/ksan/ksan.dev}:${IMAGE_TAG:-latest}
    container_name: ksan-dev
    restart: unless-stopped
    env_file:
      - .env
    networks:
      - frontend
    # Shared VPS: keep one site's leak from taking the box down with it.
    mem_limit: 512m
    cpus: 0.5
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    # `/` 307-redirects to the default locale, so probe the locale path directly.
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/en"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    labels:
      - traefik.enable=true
      - traefik.http.routers.ksan-dev-http.rule=Host(`${DOMAIN}`) || Host(`www.${DOMAIN}`)
      - traefik.http.routers.ksan-dev-http.entrypoints=web
      - traefik.http.routers.ksan-dev-https.tls=true
      - traefik.http.routers.ksan-dev-https.tls.certresolver=cloudflare
      - traefik.http.routers.ksan-dev-https.entrypoints=websecure
      - traefik.http.routers.ksan-dev-https.rule=Host(`${DOMAIN}`) || Host(`www.${DOMAIN}`)
      - traefik.http.services.ksan-dev.loadbalancer.server.port=3000

networks:
  frontend:
    external: true