# Raspberry Pi storage stack — see docker-compose.yml for the separate VPS
# stack. These two stacks are never deployed on the same host; they
# communicate only over WireGuard. See docs/PROJECT_PLAN.md §50.
#
# Deploy: copy this file and pi.env.example to the Pi, fill in pi.env,
# bring up WireGuard first (infrastructure/wireguard/), then:
#   docker compose -f docker-compose.pi.yml --env-file pi.env up -d
services:
  storage-agent:
    build:
      context: ./storage-agent
      dockerfile: Dockerfile
    restart: unless-stopped
    environment:
      # Must be the Pi's address on the WireGuard interface — never
      # 0.0.0.0 and never the Pi's LAN/public address. See §50 rule 5.
      HOST: ${STORAGE_AGENT_HOST}
      PORT: 9200
      DATA_DIR: /data/objects
      # Must match STORAGE_AGENT_TOKEN in the VPS's .env.
      AUTH_TOKEN: ${STORAGE_AGENT_TOKEN}
    volumes:
      - ${STORAGE_AGENT_DATA_PATH:-./storage-agent-data}:/data/objects
    # Intentionally no `ports:` mapping — the container binds directly to
    # the WireGuard interface's address via HOST, and Docker's own network
    # namespace still isolates it from the Pi's LAN-facing interfaces as
    # long as HOST is never 0.0.0.0.
    network_mode: host
    healthcheck:
      # Uses $HOST (not 127.0.0.1) because with network_mode: host the
      # process only accepts connections on the WireGuard interface it
      # bound to, not the loopback address.
      test: ["CMD-SHELL", "wget -qO- http://$$HOST:9200/health"]
      interval: 10s
      timeout: 5s
      retries: 5
