services:
  db:
    image: mysql:8.0
    container_name: wa_sender_db
    restart: unless-stopped
    environment:
      MYSQL_DATABASE: ${DB_NAME}
      MYSQL_USER: ${DB_USER}
      MYSQL_PASSWORD: ${DB_PASSWORD}
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
    command: --default-authentication-plugin=mysql_native_password
    volumes:
      - db_data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-p${DB_ROOT_PASSWORD}"]
      interval: 10s
      timeout: 5s
      retries: 10
    # Not exposed to the host by default — only the app talks to it.
    expose:
      - "3306"

  app:
    build: .
    container_name: wa_sender_app
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    env_file: .env
    environment:
      # Override host so the app reaches the db container by service name
      DB_HOST: db
    volumes:
      - wa_sessions:/app/storage/sessions
      - wa_uploads:/app/storage/uploads
    ports:
      # Bind to localhost only; Nginx on the host terminates TLS and proxies in.
      - "127.0.0.1:3000:3000"

volumes:
  db_data:
  wa_sessions:
  wa_uploads:
