# The Old Fitz — production compose for the VPS.
#
# Expected layout, one folder per site:
#   theoldfitz/
#     docker-compose.yaml   (this file)
#     .env                  (optional, see PROXY_NETWORK below)
#     www/                  (contents of `npm run dist`)
#     config/config.php     (live secrets — never inside www/, never in dist/)
#     data/                 (fitz.sqlite + cache/ — never inside www/)
#
# First run: create data/ and `chown 33:33 data` (www-data in the image).
# Copy config.example.php to config/config.php, fill it in, and make it
# readable by www-data (`chown root:33` + `chmod 640`). Then create the
# first admin with bin/create-user.php (see its header).
#
# The CasaOS dev host keeps its own copy of this file in the CasaOS app
# settings, with CasaOS paths and its x-casaos block.

name: the-old-fitz

networks:
  proxy:
    external: true
    # The reverse proxy's Docker network (NPM or Caddy). Set PROXY_NETWORK
    # in .env if it isn't called "proxy".
    name: ${PROXY_NETWORK:-proxy}

services:
  the-old-fitz:
    image: php:8.5-apache
    container_name: the-old-fitz
    restart: unless-stopped
    # The image ships without a php.ini, so PHP falls back to dev-style
    # defaults and shows errors (with server paths) to visitors. Activate
    # the image's bundled production ini — display_errors off, errors to
    # the log — and hide the PHP version header, then start Apache as usual.
    # Paths are spelled out (the image's $PHP_INI_DIR) rather than using
    # the variable, so no $-escaping is needed.
    command:
      - bash
      - -c
      - cp /usr/local/etc/php/php.ini-production /usr/local/etc/php/php.ini && echo 'expose_php = Off' > /usr/local/etc/php/conf.d/zz-hardening.ini && exec apache2-foreground
    networks:
      - proxy
    volumes:
      - type: bind
        source: ./www
        target: /var/www/html
      # Database and cache live outside the web root so Apache can't serve
      # them and deploys to www/ never touch them.
      - type: bind
        source: ./data
        target: /var/www/data
      # Config is mounted as a directory, not a single file: a single-file
      # bind mount pins the inode, so an editor that saves by replacing the
      # file leaves the container reading the old copy until a restart.
      - type: bind
        source: ./config
        target: /var/www/config
        read_only: true
    environment:
      - TZ=America/Indiana/Indianapolis
      - FITZ_DB_PATH=/var/www/data/fitz.sqlite
      - FITZ_CACHE_DIR=/var/www/data/cache
      - FITZ_CONFIG_PATH=/var/www/config/config.php
    # Cap container logs so PHP's error log can't slowly fill the disk.
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"