# Self-contained compose project for wisp.briggen.dev.
# Deploy: get the repo onto the server at /root/wisp, then:
#   cd /root/wisp && docker compose -f deploy/wisp.compose.yml --project-directory . up -d --build
# Joins the EXISTING external `proxy` network — the shared Traefik stack is untouched.
# Wildcard *.briggen.dev DNS + Traefik's letsencrypt resolver issue TLS automatically.
name: wisp

services:
  wisp:
    # Build the static web app (Bun + Expo export) into an nginx image that
    # serves it with the cross-origin isolation headers threaded WASM needs.
    build:
      context: .
      dockerfile: docker/web.Dockerfile
    container_name: wisp
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    # Static nginx; tiny footprint. Caps keep the blast radius off the shared host.
    mem_limit: 256m
    memswap_limit: 256m
    pids_limit: 200
    cpus: 1.0
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.wisp.rule=Host(`wisp.briggen.dev`)"
      - "traefik.http.routers.wisp.entrypoints=websecure"
      - "traefik.http.routers.wisp.tls.certresolver=letsencrypt"
      - "traefik.http.services.wisp.loadbalancer.server.port=8080"
    networks:
      - proxy

networks:
  proxy:
    external: true