# Deploy descriptor for the 15-puzzle container on the host Docker daemon.
# Driven by .gitea/workflows/ci.yaml (`docker compose up -d --build`); env
# values are interpolated from Gitea Actions secrets/variables exported by the
# deploy job. Joins the external `edge` network so the host reverse proxy can
# route to `15-puzzle:8080`.
#
# Networking:
#   - The `vpn` sidecar (developer/amneziawg-sidecar) holds an AmneziaWG
#     tunnel and provides the netns shared by `app`. `app` joins it via
#     network_mode: "service:vpn"; consequently `app` has no own network
#     config — addresses, DNS and the default route belong to `vpn`.
#   - `vpn` is the one attached to the `edge` network, with the alias
#     `15-puzzle`, so the existing caddy → 15-puzzle:8080 reverse proxy
#     continues to work without any caddy-side change. Port 8080 is
#     reachable on the alias because `app` listens on it inside the
#     shared netns.

name: 15-puzzle

services:
  vpn:
    container_name: 15-puzzle-vpn
    image: docker.iliadenisov.ru/developer/amneziawg-sidecar:latest
    restart: unless-stopped
    privileged: true
    environment:
      AWG_CONF: ${AWG_CONF:?set AWG_CONF}
    networks:
      edge:
        aliases:
          - 15-puzzle

  app:
    container_name: 15-puzzle
    image: 15-puzzle:latest
    build:
      context: ..
      dockerfile: Dockerfile
    restart: unless-stopped
    depends_on:
      - vpn
    network_mode: "service:vpn"
    environment:
      BOT_TOKEN: ${BOT_TOKEN:?set BOT_TOKEN}
      ACCESS_CODE: ${ACCESS_CODE:?set ACCESS_CODE}
      PROJECT_LINK: ${PROJECT_LINK:?set PROJECT_LINK}
      DATA_FILE: ${DATA_FILE:-/data/data.json}
      SERVER_PORT: ${SERVER_PORT:-8080}
      CONTEXT_ROOT: ${CONTEXT_ROOT:-/}
    volumes:
      - data:/data

volumes:
  data:
    name: 15-puzzle-data

networks:
  edge:
    external: true