when/docs/compose.yaml

services:
  when-app:
    # Pin web, worker and CLI to matching published versions for controlled updates.
    image: ghcr.io/eleith/when:latest
    platform: linux/amd64
    # Optional values for ${VAR} references in when.yaml.
    env_file:
      - path: .env
        required: false
    environment:
      # Only trust this header from the private, configured reverse proxy.
      PROTOCOL_HEADER: x-forwarded-proto
    ports:
      # Localhost only. Use '3000:3000' for LAN access; restrict it with your firewall.
      - '127.0.0.1:${WHEN_HTTP_PORT:-3000}:3000'
    volumes:
      - ./config:/app/config:ro
      - ./data:/app/data
      - ./public:/app/public:ro
    restart: unless-stopped
    depends_on:
      when-worker:
        condition: service_healthy
    healthcheck:
      test:
        - CMD
        - node
        - --eval
        - fetch('http://localhost:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
      interval: 30s
      timeout: 3s
      start_period: 5s
      retries: 3

  when-worker:
    image: ghcr.io/eleith/when-worker:latest
    platform: linux/amd64
    env_file:
      - path: .env
        required: false
    # Health and metrics stay on the Compose network. No published worker port.
    volumes:
      - ./config:/app/config:ro
      - ./data:/app/data
    restart: unless-stopped
    healthcheck:
      test:
        - CMD
        - node
        - --eval
        - fetch('http://localhost:9000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
      interval: 30s
      timeout: 3s
      start_period: 5s
      retries: 3

  when-cli:
    image: ghcr.io/eleith/when-cli:latest
    platform: linux/amd64
    profiles:
      - tools
    env_file:
      - path: .env
        required: false
    volumes:
      # Writable so config init can create a starter file. Other services only read it.
      - ./config:/app/config
      - ./data:/app/data