docker-compose.yml

version: '3.8'

services:
  aware-backend:
    build: .
    container_name: aware-backend
    ports:
      - "${API_PORT:-3000}:${API_PORT:-3000}"
    environment:
      - NODE_ID=${NODE_ID:-node-1}
      - DISCOVERY_PORT=${DISCOVERY_PORT:-41234}
      - BROADCAST_PORT=${BROADCAST_PORT:-41235}
      - API_PORT=${API_PORT:-3000}
      - NODE_LIST=${NODE_LIST:-}
      # SEC-004: shell `:-`
      # expansion silently set a publicly-known JWT signing key when the
      # operator forgot to set the env var. Replaced with `:?` so
      # `docker compose up` fails fast with a clear error if the env is
      # unset or empty. Mirror the v1 auth.js:6-12 fail-closed pattern.
      - SECRET_KEY=${SECRET_KEY:?SECRET_KEY must be set (SEC-004)}
    volumes:
      - ./data:/app/data  # For persistent data
    networks:
      - aware-network
    restart: unless-stopped

  aware-frontend:
    build:
      context: .
      dockerfile: Dockerfile.ui
    container_name: aware-frontend
    ports:
      - "3001:8080"  # Serve frontend separately on port 3001 (was 80 in v1.0.0; changed to 8080 for unprivileged-nginx compatibility)
    depends_on:
      - aware-backend
    environment:
      - REACT_APP_API_URL=${REACT_APP_API_URL:-http://localhost:${API_PORT:-3000}/api}
    networks:
      - aware-network
    restart: unless-stopped

networks:
  aware-network:
    driver: bridge

volumes:
  aware_data: