VPS Build Plan

# QCTOCloud — Coolify Docker Compose Resource
# Add via Coolify: Project → QCTO Submissions → + Add Resource → Docker Compose
# Coolify Traefik handles SSL automatically — no Nginx/Caddy needed
# Set all env vars in Coolify → Resource → Environment Variables (not in this file)

version: "3.9"

services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${DB_NAME:-qctocloud}
      POSTGRES_USER: ${DB_USER:-qcto}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - pgdata:/var/lib/postgresql/data
    networks: [qctocloud_net]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-qcto} -d ${DB_NAME:-qctocloud}"]
      interval: 10s
      timeout: 5s
      retries: 5
    expose: ["5432"]   # internal only — never expose DB port to host

  app:
    image: ghcr.io/edunimbus/qctocloud:${IMAGE_TAG:-latest}
    restart: unless-stopped
    environment:
      NODE_ENV: production
      DATABASE_URL: postgres://${DB_USER:-qcto}:${DB_PASSWORD}@db:5432/${DB_NAME:-qctocloud}
      NEXTAUTH_URL: https://${APP_DOMAIN}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
    depends_on:
      db:
        condition: service_healthy
    networks: [qctocloud_net]
    expose: ["13000"]
    # Coolify Traefik labels (auto-added by Coolify — listed here for reference)
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.qctocloud-${TENANT_SLUG}.rule=Host(`${APP_DOMAIN}`)"
      - "traefik.http.routers.qctocloud-${TENANT_SLUG}.tls=true"
      - "traefik.http.routers.qctocloud-${TENANT_SLUG}.tls.certresolver=letsencrypt"
      - "traefik.http.services.qctocloud-${TENANT_SLUG}.loadbalancer.server.port=13000"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:13000/api/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s

volumes:
  pgdata:
    name: qctocloud_${TENANT_SLUG}_pgdata

networks:
  qctocloud_net:
    name: qctocloud_${TENANT_SLUG}_net
    driver: bridge