services:
  backend:
    build: ./backend
    security_opt:
      - apparmor=unconfined
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
      - APP_SLUG=kitchen
      - STACK_INTERNAL_SECRET=${STACK_INTERNAL_SECRET:-}
      - SETTINGS_URL=${SETTINGS_URL:-}
      - SETTINGS_SECRET=${SETTINGS_SECRET:-}
      - AZURE_DI_ENDPOINT=${AZURE_DI_ENDPOINT:-}
      - AZURE_DI_KEY=${AZURE_DI_KEY:-}
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
      - OFFICE_IP_CHECK=${OFFICE_IP_CHECK:-}
    ports:
      # Expose 8000 on the host so KDS can call /api/internal/resos/bookings
      # directly on the bridge network (10.10.10.110:8000). nginx blocks
      # /kitchen/api/internal/ on the public side.
      - "8000:8000"
    volumes:
      - invoice_data:/app/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 60s
    restart: unless-stopped

  frontend:
    build:
      context: ./frontend
      args:
        VITE_HOTEL_NAME: ${VITE_HOTEL_NAME:-Hotel}
    security_opt:
      - apparmor=unconfined
    ports:
      - "${FRONTEND_PORT:-3080}:80"
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped

networks:
  default:
    driver: bridge

volumes:
  invoice_data: