services:
  app:
    # Built and pushed by .github/workflows/ci.yml on every push to main.
    # Watchtower on the server picks up new digests on this tag automatically.
    image: ${APP_IMAGE:-ghcr.io/nfonteyne/octane-website:latest}
    restart: unless-stopped
    env_file: .env
    ports:
      - "${APP_PORT:-3000}:3000"
    depends_on:
      - postgres
    networks:
      - default
      - authentik

  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: octane
      POSTGRES_USER: octane
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - pgdata:/var/lib/postgresql/data
    networks:
      - default

networks:
  default:
  authentik:
    external: true
    name: ${AUTHENTIK_NETWORK_NAME:-authentik_default}

volumes:
  pgdata: