docker-compose.yml

services:
  postgres:
    image: postgres:16-alpine
    container_name: eastbrook-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: eastbrook
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env. See .env.example.}
      POSTGRES_DB: eastbrook
    ports:
      - "127.0.0.1:5433:5432"
    volumes:
      - eastbrook_pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U eastbrook -d eastbrook"]
      interval: 5s
      timeout: 3s
      retries: 10

  # The full game server (client + API + world). `docker compose up -d`
  # then open http://localhost:8787 — or put a TLS reverse proxy in front
  # for remote hosting (see README).
  game:
    build:
      context: .
      args:
        # Build-time public client config inlined into the bundle (see .env.example).
        VITE_TURNSTILE_SITEKEY: ${VITE_TURNSTILE_SITEKEY:-}
    container_name: eastbrook-game
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DATABASE_URL: postgres://eastbrook:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env. See .env.example.}@postgres:5432/eastbrook
      PORT: "8787"
      # Target the game server 302-redirects /wiki to when hit directly (not via the
      # reverse proxy). Public origin in prod; localhost fallback for local dev.
      WIKI_URL: ${WIKI_URL:-http://localhost:8080/wiki/index.php/Main_Page}
      # Runtime public origin for server-generated absolute URLs such as player-card
      # Open Graph images. Set per environment, for example dev vs production.
      PUBLIC_ORIGIN: ${PUBLIC_ORIGIN:-}
      USERNAME_BANLIST: ${USERNAME_BANLIST:-}
      USERNAME_BANLIST_FILE: ${USERNAME_BANLIST_FILE:-}
      CHAT_CENSOR_LIST: ${CHAT_CENSOR_LIST:-}
      CHAT_CENSOR_FILE: ${CHAT_CENSOR_FILE:-}
      # Runtime: server-side Turnstile verification (see .env.example). Empty → gate off.
      TURNSTILE_SECRET: ${TURNSTILE_SECRET:-}
      # Runtime: native app attestation for iOS DeviceCheck and Google Play Integrity.
      # Secrets are read from .env on the host and passed through to the container.
      NATIVE_ATTESTATION_REQUIRED: ${NATIVE_ATTESTATION_REQUIRED:-}
      GOOGLE_PLAY_INTEGRITY_SERVICE_ACCOUNT_JSON: ${GOOGLE_PLAY_INTEGRITY_SERVICE_ACCOUNT_JSON:-}
      GOOGLE_PLAY_INTEGRITY_SIGNING_PEM: ${GOOGLE_PLAY_INTEGRITY_SIGNING_PEM:-}
      GOOGLE_PLAY_INTEGRITY_PACKAGE_NAME: ${GOOGLE_PLAY_INTEGRITY_PACKAGE_NAME:-com.worldofclaudecraft}
      GOOGLE_PLAY_INTEGRITY_CERT_DIGESTS: ${GOOGLE_PLAY_INTEGRITY_CERT_DIGESTS:-}
      GOOGLE_PLAY_INTEGRITY_DEVICE_VERDICT: ${GOOGLE_PLAY_INTEGRITY_DEVICE_VERDICT:-MEETS_DEVICE_INTEGRITY}
      APPLE_TEAM_ID: ${APPLE_TEAM_ID:-}
      APPLE_BUNDLE_ID: ${APPLE_BUNDLE_ID:-com.worldofclaudecraft}
      APPLE_DEVICECHECK_KEY_ID: ${APPLE_DEVICECHECK_KEY_ID:-}
      APPLE_DEVICECHECK_SIGNING_PEM: ${APPLE_DEVICECHECK_SIGNING_PEM:-}
      APPLE_DEVICECHECK_ENV: ${APPLE_DEVICECHECK_ENV:-production}
      # Runtime: protects the loopback-only deploy countdown endpoint.
      RESTART_COUNTDOWN_SECRET: ${RESTART_COUNTDOWN_SECRET:-}
    # loopback-only: the TLS reverse proxy (Caddy) is the public entrance
    ports:
      - "127.0.0.1:8787:8787"
    volumes:
      - ${EASTBROOK_MEDIA_DIR:-./media-cache}:/app/dist/media

  mediawiki-db:
    image: mariadb:11
    container_name: eastbrook-wiki-db
    restart: unless-stopped
    environment:
      MYSQL_DATABASE: ${MEDIAWIKI_DB_NAME:-mediawiki}
      MYSQL_USER: ${MEDIAWIKI_DB_USER:-mediawiki}
      MYSQL_PASSWORD: ${MEDIAWIKI_DB_PASSWORD:-mediawiki-change-me}
      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
    volumes:
      - eastbrook_wikidb:/var/lib/mysql
    healthcheck:
      test: ["CMD-SHELL", "mariadb-admin ping -h 127.0.0.1 -u${MEDIAWIKI_DB_USER:-mediawiki} -p${MEDIAWIKI_DB_PASSWORD:-mediawiki-change-me} --silent"]
      interval: 5s
      timeout: 3s
      retries: 20

  mediawiki:
    build:
      context: .
      dockerfile: mediawiki/Dockerfile
    container_name: eastbrook-wiki
    restart: unless-stopped
    depends_on:
      mediawiki-db:
        condition: service_healthy
    environment:
      MEDIAWIKI_DB_HOST: mediawiki-db
      MEDIAWIKI_DB_NAME: ${MEDIAWIKI_DB_NAME:-mediawiki}
      MEDIAWIKI_DB_USER: ${MEDIAWIKI_DB_USER:-mediawiki}
      MEDIAWIKI_DB_PASSWORD: ${MEDIAWIKI_DB_PASSWORD:-mediawiki-change-me}
      MEDIAWIKI_ADMIN_USER: ${MEDIAWIKI_ADMIN_USER:-WikiAdmin}
      MEDIAWIKI_ADMIN_PASS: ${MEDIAWIKI_ADMIN_PASS:-change-me-admin-password}
      MEDIAWIKI_SECRET_KEY: ${MEDIAWIKI_SECRET_KEY:-local-dev-change-me-world-of-claudecraft}
      MEDIAWIKI_UPGRADE_KEY: ${MEDIAWIKI_UPGRADE_KEY:-local-dev-upgrade-key}
      MEDIAWIKI_SERVER: ${MEDIAWIKI_SERVER:-http://localhost:8080}
    ports:
      - "127.0.0.1:8080:80"
    volumes:
      - eastbrook_wiki_images:/var/www/html/images

volumes:
  eastbrook_pgdata:
  eastbrook_wikidb:
  eastbrook_wiki_images: