services:
  cofi-register:
    build: .
    container_name: cofi-register
    restart: unless-stopped
    environment:
      # Infisical secret injection (secrets fetched at container startup)
      - INFISICAL_CLIENT_ID=${INFISICAL_CLIENT_ID}
      - INFISICAL_CLIENT_SECRET=${INFISICAL_CLIENT_SECRET}
      - INFISICAL_PROJECT_SLUG=cofi-register
      # Non-secret config (defaults inline)
      - NODE_ENV=production
      - NEXT_PUBLIC_BASE_URL=${NEXT_PUBLIC_BASE_URL:-https://crypto-commons.org}
      - GOOGLE_SHEET_NAME=${GOOGLE_SHEET_NAME:-Registrations}
      - BOOKING_SHEET_NAME=${BOOKING_SHEET_NAME:-Sheet1}
      - SMTP_HOST=${SMTP_HOST:-mail.rmail.online}
      - SMTP_PORT=${SMTP_PORT:-587}
      - LISTMONK_DB_HOST=${LISTMONK_DB_HOST:-listmonk-db}
      - LISTMONK_DB_PORT=${LISTMONK_DB_PORT:-5432}
      - LISTMONK_DB_NAME=${LISTMONK_DB_NAME:-listmonk}
      - LISTMONK_DB_USER=${LISTMONK_DB_USER:-listmonk}
      - LISTMONK_LIST_ID=${LISTMONK_LIST_ID:-27}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.cofi-register.rule=Host(`cofi-register-staging.jeffemmett.com`)"
      - "traefik.http.routers.cofi-register.entrypoints=web,websecure"
      - "traefik.http.services.cofi-register.loadbalancer.server.port=3000"
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:3000/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    networks:
      - traefik-public
      - listmonk-internal

networks:
  traefik-public:
    external: true
  listmonk-internal:
    external:
      name: listmonk_listmonk-internal