docker-compose.yaml

services:
  # ===========================================
  # Nomad (single container — API + frontend)
  # ===========================================
  # In SAN mode the backend serves the built frontend (same-origin).
  # No separate frontend container or nginx proxy needed.
  nomad:
    container_name: nomad
    build:
      context: .
      dockerfile: backend/Dockerfile
      args:
        - VITE_MAPBOX_TOKEN=${VITE_MAPBOX_TOKEN}
        - VITE_API_BASE_URL=${VITE_API_BASE_URL:-}
        - VITE_AUTH_MODE=${VITE_AUTH_MODE:-simple}
    ports:
      - "${NOMAD_FRONTEND_HOST_PORT}:3001"
    volumes:
      # WARNING: Docker socket mount - see Security Considerations in README
      - /var/run/docker.sock:/var/run/docker.sock
      # FireSTARR dataset - same mount as firestarr-app for fuel grids + sims
      - ${FIRESTARR_DATASET_PATH}:/appl/data
      # Mount compose files so backend can spawn FireSTARR containers
      - ./docker-compose.yaml:/app/docker-compose.yaml:ro
      - ./.env:/app/.env:ro
      - ./.env:/app/host.env:ro
    environment:
      - NODE_ENV=production
      - PORT=3001
      # Override to use container path (not host relative path from .env)
      - FIRESTARR_DATASET_PATH=/appl/data
      - NOMAD_DATA_PATH=/appl/data
      # Authentication mode for SAN (none|simple|oauth)
      - NOMAD_AUTH_MODE=${NOMAD_AUTH_MODE:-simple}
      - VITE_AUTH_MODE=${VITE_AUTH_MODE:-simple}
    env_file:
      - .env
    restart: unless-stopped

  # ===========================================
  # FireSTARR Model Engine
  # ===========================================
  # NOTE: This service is NOT started with `docker compose up`.
  # It's a template used by `docker compose run firestarr-app <command>`.
  # The backend's DockerExecutor spawns ephemeral containers for each job.
  firestarr-app:
    image: ${FIRESTARR_IMAGE:?FIRESTARR_IMAGE must be set in .env - run the installer}
    profiles: ["modeling"]  # Prevents auto-start with `docker compose up`
    # Update settings.ini RASTER_ROOT to match our mount point before running
    entrypoint: ["/bin/sh", "-c", "sed -i 's|RASTER_ROOT.*|RASTER_ROOT = /appl/data/generated/grid/100m|' /appl/firestarr/settings.ini && exec \"$$@\"", "--"]
    volumes:
      - /etc/ssl/certs:/etc/ssl/certs
      - ${FIRESTARR_DATASET_PATH}:/appl/data
      - ${FIRESTARR_DATASET_PATH}/sims:/appl/data/sims