# The deploy tools are here too, pinned, so nothing gets installed on the
# host. They sit in the "tools" profile: `docker compose up -d` still starts
# only the site, and `docker compose run --rm terraform ...` /
# `... railway ...` runs them.

x-tool: &tool
  profiles: [tools]
  # As you, so what they write into the repo (.terraform/, state, lock files)
  # is yours and not root's.
  user: "${UID:-1000}:${GID:-1000}"
  working_dir: /work
  volumes:
    - .:/work
  environment:
    # The Terraform provider reads RAILWAY_TOKEN; the CLI reads a workspace
    # token only as RAILWAY_API_TOKEN (RAILWAY_TOKEN is a project token to it).
    - RAILWAY_TOKEN=${RAILWAY_API_TOKEN:-}
    - RAILWAY_API_TOKEN
    - CLOUDFLARE_API_TOKEN
    - HOME=/tmp

services:
  bible:
    build: .
    image: bible-offline
    container_name: bible
    ports:
      # Host port is overridable: BIBLE_PORT=9000 docker compose up -d
      - "${BIBLE_PORT:-8085}:8080"
    volumes:
      # Live edits without rebuilding. server.py and worker.py are mounted
      # too: leaving them baked into the image is how an old copy once kept
      # running for days after the file on disk had changed. Drop these lines
      # to serve the copy baked into the image instead.
      - ./server.py:/srv/server.py:ro
      - ./worker.py:/srv/worker.py:ro
      - ./assets:/srv/assets:ro
      - ./bible:/srv/bible:ro
    restart: unless-stopped

  terraform:
    <<: *tool
    image: hashicorp/terraform:1.16.3

  railway:
    <<: *tool
    build: infra/railway-cli
    image: railway-cli:5.57.12
    # The CLI takes RAILWAY_TOKEN as a project token if it is set at all.
    environment:
      - RAILWAY_API_TOKEN
      - HOME=/tmp