docker-compose.yml

services:
  api:
    build:
      context: .
      args:
        GIT_COMMIT: ${GIT_COMMIT:-dev}
        BUILD_DATE: ${BUILD_DATE:-unknown}
    container_name: satrank-api
    restart: unless-stopped
    ports:
      # Loopback only. Public path is Internet → nginx → Express on
      # 127.0.0.1:3000. Binding to 0.0.0.0 would bypass nginx rate limits
      # and the L402 native gate if the host firewall ever drops its rules.
      - "127.0.0.1:${PORT:-3000}:3000"
    env_file:
      - .env.production
    environment:
      - GIT_COMMIT=${GIT_COMMIT:-dev}
      - BUILD_DATE=${BUILD_DATE:-unknown}
    volumes:
      - satrank-data:/app/data
      # LND macaroon for the L402 paid gate. Baked out-of-band:
      #   lncli bakemacaroon --save_to <remote_dir>/fulfill.macaroon \
      #     offchain:read offchain:write invoices:read invoices:write
      # Set LND_MACAROON_PATH=/app/macaroons/fulfill.macaroon in .env.production.
      # Excluded from rsync (*.macaroon in .rsync-exclude) so each host owns its own.
      # Optional: when missing, /api/intent + /api/deposit return 503 L402_NOT_CONFIGURED.
      - ./fulfill.macaroon:/app/macaroons/fulfill.macaroon:ro
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      start_period: 30s
      retries: 3
    stop_grace_period: 30s
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1024M

volumes:
  satrank-data:
    driver: local