services:
  backend:
    image: ${REGISTRY}/pos-backend:${VERSION:-latest}
    restart: unless-stopped
    environment:
      - SITE_ID=${SITE_ID}
      - SITE_KEY=${SITE_KEY}
      - CLOUD_URL=${CLOUD_URL}
      - SECRET_KEY=${SECRET_KEY}
      - LICENSE_GRACE_HOURS=${LICENSE_GRACE_HOURS:-24}
      - DATABASE_URL=sqlite:////app/data/pos.db
      - VERSION=${VERSION:-0.0.0}
      - HOST_IP=${HOST_IP:-}
      - MASTER_USERNAME=${MASTER_USERNAME:-}
      - MASTER_PASSWORD=${MASTER_PASSWORD:-}
    volumes:
      - ${DATA_PATH}:/app/data
      - ${LOGO_PATH}:/app/logo.png:ro
      - ${FISCAL_PATH}:/mnt/fiscal
      - netinfo:/netinfo:ro

  # Finds the server's LAN IP on the PHYSICAL network (never a VPN) every minute
  # and shares it with the backend (pairing QR, manager, heartbeat). Needs the
  # host's network namespace because the backend's bridge network can't see
  # real NICs. Same image as the backend — see services/netinfo_helper.py.
  netinfo:
    image: ${REGISTRY}/pos-backend:${VERSION:-latest}
    restart: unless-stopped
    network_mode: host
    command: ["python", "-m", "services.netinfo_helper"]
    volumes:
      - netinfo:/netinfo

  waiter_pwa:
    image: ${REGISTRY}/pos-waiter:${VERSION:-latest}
    restart: unless-stopped
    depends_on:
      - backend

  manager_dashboard:
    image: ${REGISTRY}/pos-manager:${VERSION:-latest}
    restart: unless-stopped
    depends_on:
      - backend

  proxy:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
      - "4443:4443"
      - "8081:8081"   # manager over plain HTTP (LAN only)
    volumes:
      - ./nginx-proxy/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./certs:/etc/nginx/certs:ro
    depends_on:
      - waiter_pwa
      - manager_dashboard
    restart: unless-stopped

volumes:
  netinfo: