# WristCode gateway: the backend for the WristCode Apple Watch app (git.gbrown.org/gib/wristcode).
# It holds a WebSocket to every T3 Code server, serves the watch's HTTPS API, and sends APNs pushes.
# NPM serves wristcode.gbrown.org and forwards to wristcode-gateway:8080 over nginx-bridge.
#
# .env beside this file (mode 600):
#   APNS_KEY_ID=...                the APNs key's ID
#   APNS_TEAM_ID=GQJNM5YK2M
#   APNS_KEY_PATH=/data/apns.p8    the .p8 file, in ./data
#
# Operator CLI: podman exec -it wristcode-gateway wristcode <host add|pair|device list|...>
networks:
  nginx-bridge:
    external: true            # ALWAYS external; see AGENTS.md §5

services:
  wristcode-gateway:
    image: git.gbrown.org/gib/wristcode-gateway:latest
    container_name: wristcode-gateway
    hostname: wristcode-gateway
    domainname: wristcode.gbrown.org
    networks: ['nginx-bridge']
    env_file: [.env]
    environment:
      - TZ=America/New_York
    # The image runs as `bun` (uid 1000). keep-id maps it to gib, so ./data stays gib-owned (AGENTS.md §3.2).
    userns_mode: "keep-id:uid=1000,gid=1000"
    volumes:
      - ./data:/data:z        # lowercase :z survives update-containers recreates, as in Agentchat
    restart: unless-stopped
    healthcheck:
      test: wget -qO- http://127.0.0.1:8080/v1/health || exit 1
      interval: 30s
      start_period: 10s