services:
  visitor-signin:
    build: .
    image: visitor-signin:latest
    # Built from this folder, never fetched from a registry. Without this,
    # `docker compose pull` fails trying to find it on Docker Hub.
    pull_policy: build
    container_name: visitor-signin
    restart: unless-stopped
    env_file:
      - .env
    ports:
      # The kiosk and admin console, over https.
      - "${HOST_PORT:-8443}:3000"
      # Plain http helper: serves /ca.crt and redirects everything else to https.
      # Drop this line if you are not using the built-in certificate.
      - "${HOST_HTTP_PORT:-8080}:3001"
    volumes:
      # Database, visitor photos and the certificates live here.
      - ./data:/data
      # Google service account key, if you mount it as a file rather than base64 in .env.
      - ./secrets:/secrets:ro
    healthcheck:
      test: ["CMD", "node", "scripts/healthcheck.mjs"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s