services:
  backend:
    image: git.menzel.center/menzeljonas/stackpilot-backend:latest
    build: ./backend
    restart: unless-stopped
    environment:
      - SECRET_KEY=${SECRET_KEY}
      - STACKS_DIR=/opt/stacks
      - DATA_DIR=/data
      - HOST_PROC_PATH=/host_proc
      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5009}
      # Optional: comma-separated generic JSON webhook URLs (every event).
      # Per-destination webhooks (ntfy/Discord/Slack/Gotify) are managed in the UI.
      - NOTIFY_WEBHOOKS=${NOTIFY_WEBHOOKS:-}
      # Throwaway image used to snapshot named-volume contents during backups.
      - BACKUP_HELPER_IMAGE=${BACKUP_HELPER_IMAGE:-alpine:latest}
      # File browser (sidebar) + volume host-path picker. Admin-only, and
      # ALLOWED_BROWSE_ROOTS limits which paths are reachable -- note that a
      # single "/" in that list disables the limit entirely. StackPilot's own
      # DATA_DIR is always refused. HOST_ROOT_PREFIX is where the host
      # filesystem is mounted inside this container (see the volume below).
      - ALLOWED_BROWSE_ROOTS=${ALLOWED_BROWSE_ROOTS:-/mnt,/media,/srv,/opt,/home}
      - HOST_ROOT_PREFIX=${HOST_ROOT_PREFIX:-}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data:/data
      # MUST resolve to the same path as STACKS_DIR above: compose runs inside
      # this container and resolves a stack's relative bind mounts (./config)
      # against the container path, which the daemon then creates at that same
      # path on the host. A different host path means the stacks' data lands
      # somewhere StackPilot cannot see (file browser, editor).
      - ${STACKS_HOST_DIR:-/opt/stacks}:/opt/stacks
      - /proc:/host_proc:ro
      # Host devices for GPU/device detection + passthrough (USB/TTY/DRI).
      # Read-only; remove if you don't need GPU/device features.
      - /dev:/dev:ro
      # File browser: to browse/manage the real host filesystem, mount it here
      # and set HOST_ROOT_PREFIX=/host_root in .env. Use :ro for read-only
      # browsing, or drop :ro to allow edits/uploads/deletes from the UI.
      # - /:/host_root
    expose:
      - "5008"
    # Uncomment to expose the API directly (normally proxied by the frontend):
    # ports:
    #   - "5008:5008"

  frontend:
    image: git.menzel.center/menzeljonas/stackpilot-frontend:latest
    build: ./frontend
    restart: unless-stopped
    depends_on:
      - backend
    ports:
      - "5009:80"