docker-compose.dokploy.yml

services:
  backend:
    build: ./backend
    restart: unless-stopped
    networks:
      - dokploy-network
    environment:
      S3_ENDPOINT: ${S3_ENDPOINT:-http://host.docker.internal:9000}
      S3_ACCESS_KEY: ${S3_ACCESS_KEY}
      S3_SECRET_KEY: ${S3_SECRET_KEY}
      S3_BUCKET: ${S3_BUCKET:-satisfactory-tracker}
      ASSETS_BUCKET: ${ASSETS_BUCKET:-satisfactory-assets}
      ASSETS_BASE_URL: ${ASSETS_BASE_URL:-https://s3.cevdetbaran.com/satisfactory-assets}
      CORS_ORIGINS: ${CORS_ORIGINS:-https://sap.cevdetbaran.com}
      SECRET_KEY: ${SECRET_KEY}
      REQUIRE_WRITE_TOKEN: ${REQUIRE_WRITE_TOKEN:-false}
      MAX_BODY_BYTES: ${MAX_BODY_BYTES:-262144}
      SILENCE_HEALTH_LOGS: ${SILENCE_HEALTH_LOGS:-true}
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - import urllib.request; urllib.request.urlopen('http://localhost:8000/health')
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    restart: unless-stopped
    networks:
      - dokploy-network
    depends_on:
      backend:
        condition: service_healthy
    labels:
      - traefik.enable=true
      - traefik.docker.network=dokploy-network
      # HTTP router: serve the SPA directly. Cloudflare's "Always Use
      # HTTPS" page rule enforces HTTPS at the edge — adding a Traefik
      # redirectScheme here would loop because Cloudflare proxy hits
      # origin on port 80 (Flexible SSL between edge and origin).
      - traefik.http.routers.sap-web.rule=Host(`sap.cevdetbaran.com`)
      - traefik.http.routers.sap-web.entrypoints=web
      - traefik.http.routers.sap-web.service=sap-svc
      # HTTPS router: also terminate TLS at origin via Let's Encrypt so
      # CF can talk to us in Full (strict) mode if the user upgrades the
      # SSL setting later. Same backend service.
      - traefik.http.routers.sap-secure.rule=Host(`sap.cevdetbaran.com`)
      - traefik.http.routers.sap-secure.entrypoints=websecure
      - traefik.http.routers.sap-secure.tls=true
      - traefik.http.routers.sap-secure.tls.certresolver=letsencrypt
      - traefik.http.routers.sap-secure.service=sap-svc
      - traefik.http.services.sap-svc.loadbalancer.server.port=80

networks:
  dokploy-network:
    external: true