# BizGaze Support — deployed behind the existing Nginx Proxy Manager.
# No host ports are published: NPM reaches this container by name on the
# shared `nginx_proxy_manager_default` network. TLS is terminated by NPM,
# which proxies https://remote.bizgaze.com -> bizgaze-support:8090.
services:
  app:
    build: .
    image: bizgaze-support:latest
    container_name: bizgaze-support
    restart: unless-stopped
    environment:
      - PORT=8090
      - DB_PATH=/data/data.db
      # Desktop installers + auto-update feed live on the persistent volume so uploaded
      # builds survive image rebuilds (a plain image path would be wiped on every deploy).
      - DOWNLOADS_DIR=/data/downloads
    # Secrets (TURN credentials, SSO_SECRET, BIZGAZE_WEBHOOK_URL, etc.) live in
    # a .env file next to this compose file. It is gitignored — never committed.
    # See .env.example for the expected keys.
    env_file:
      - path: .env
        required: false
    volumes:
      - bizgaze_support_data:/data   # persists data.db across rebuilds
    networks:
      - npm

  # LiveKit SFU — meeting media server. Optional: only started/used when the app's .env has
  # LIVEKIT_URL/API_KEY/API_SECRET set (otherwise meetings use the built-in P2P mesh). NPM proxies
  # wss://livekit.bizgaze.com -> livekit:7880 (signaling); media flows over the published UDP/TCP
  # ports below, NOT through NPM. Single-node (no Redis) — consistent with the app's single-instance rule.
  livekit:
    image: livekit/livekit-server:v1.7
    container_name: bizgaze-livekit
    restart: unless-stopped
    command: --config /etc/livekit.yaml
    environment:
      # key: secret, sourced from the same .env as the app so both sign/verify with the same secret.
      - "LIVEKIT_KEYS=${LIVEKIT_API_KEY}: ${LIVEKIT_API_SECRET}"
    volumes:
      - ./livekit.yaml:/etc/livekit.yaml:ro
    ports:
      - "7881:7881"                    # WebRTC over TCP (fallback)
      - "50000-50100:50000-50100/udp"  # WebRTC media (UDP) — must match livekit.yaml port range
    networks:
      - npm

networks:
  npm:
    external: true
    name: nginx_proxy_manager_default

volumes:
  bizgaze_support_data: