# =============================================================================
# Veritas Kanban — Demo Environment
# =============================================================================
# One command: docker compose -f demo/docker-compose.demo.yml up --build
# Then open: http://localhost:3099
#
# Automatically seeds demo data on first run via the seed sidecar.
#
# LOCAL DEMO ONLY:
# - Defaults to DEMO_BIND=127.0.0.1 and VERITAS_AUTH_ENABLED=false.
# - Do not set DEMO_BIND=0.0.0.0 unless auth is enabled and credentials are replaced.
# =============================================================================

services:
  vk-demo:
    build:
      context: ..
      dockerfile: Dockerfile
    container_name: vk-demo
    working_dir: /app/server
    ports:
      - '${DEMO_BIND:-127.0.0.1}:${DEMO_PORT:-3099}:3001'
    environment:
      - NODE_ENV=production
      - PORT=3001
      - DATA_DIR=/app/data
      # Fixed local demo credential. Replace before enabling non-loopback access.
      - VERITAS_ADMIN_KEY=${VERITAS_ADMIN_KEY:-demo-admin-key-2026}
      # Auth-disabled mode is safe only with DEMO_BIND left at 127.0.0.1.
      - VERITAS_AUTH_ENABLED=${VERITAS_AUTH_ENABLED:-false}
      - VERITAS_AUTH_LOCALHOST_BYPASS=true
      - VERITAS_AUTH_LOCALHOST_ROLE=admin
      - CORS_ORIGINS=http://localhost:${DEMO_PORT:-3099}
    volumes:
      - demo-data:/app/data
    restart: unless-stopped
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://localhost:3001/health']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s

  vk-demo-seed:
    image: alpine:3.19
    container_name: vk-demo-seed
    depends_on:
      vk-demo:
        condition: service_healthy
    volumes:
      - ./seed.sh:/seed/seed.sh:ro
    entrypoint: ['sh', '/seed/seed.sh']
    environment:
      - API_URL=http://vk-demo:3001
      - ADMIN_KEY=${VERITAS_ADMIN_KEY:-demo-admin-key-2026}

volumes:
  demo-data:
    driver: local