docker-compose.yml

# Production deployment for a single VPS.
#
#   1. Point an A record at this host.
#   2. Set DOMAIN and ACME_EMAIL in .env (see .env.example).
#   3. docker compose up -d --build
#
# Caddy terminates TLS with an automatically provisioned Let's Encrypt
# certificate and renews it without intervention. Neither application
# container publishes a port to the host -- only Caddy is reachable.

name: race-intelligence

services:
  backend:
    build:
      context: ./backend
    restart: unless-stopped
    environment:
      RI_DATABASE_URL: sqlite:////data/race_intelligence.db
      RI_CORS_ORIGINS: '["https://${DOMAIN}"]'
      RI_ANTHROPIC_API_KEY: ${RI_ANTHROPIC_API_KEY:-}
    volumes:
      - backend-data:/data
    networks: [internal]
    # Simulation is CPU-bound NumPy. Capping it stops a 50,000-race request
    # from starving Caddy and the frontend on a small VPS.
    deploy:
      resources:
        limits:
          cpus: "1.5"
          memory: 1G

  frontend:
    build:
      context: ./frontend
      args:
        NEXT_PUBLIC_API_ORIGIN: http://backend:8000
    restart: unless-stopped
    depends_on:
      backend:
        condition: service_healthy
    networks: [internal]
    deploy:
      resources:
        limits:
          memory: 512M

  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    environment:
      DOMAIN: ${DOMAIN}
      ACME_EMAIL: ${ACME_EMAIL}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data      # certificates -- losing this means re-issuing
      - caddy-config:/config
    depends_on: [frontend, backend]
    networks: [internal]

networks:
  internal:

volumes:
  backend-data:
  caddy-data:
  caddy-config: