docker-compose.sim.yml

# Safe public deployment of the ReadIssue SIMULATOR.
#
#   - `sim` runs the queueing-model API + dashboard. It has NO published ports:
#     it is only reachable from inside the compose network.
#   - `caddy` is the only thing exposed to the internet. It terminates TLS
#     (automatic HTTPS via Let's Encrypt when SITE_ADDRESS is a domain),
#     enforces HTTP basic auth, and reverse-proxies everything to `sim`
#     (including the /ws WebSocket, which Caddy upgrades automatically).
#
# Copy .env.sim.example to .env and fill it in first. Then:
#   docker compose -f docker-compose.sim.yml up -d --build

name: readissue-sim

services:
  sim:
    build:
      context: .
      dockerfile: sim/Dockerfile
    environment:
      MAX_WORKERS: ${MAX_WORKERS:-8}
      START_INSTANCES: ${START_INSTANCES:-1}
      TICK_INTERVAL: ${TICK_INTERVAL:-1.0}
    expose:
      - "8000"           # visible to caddy only, NOT published to the host
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/health').status==200 else 1)\""]
      interval: 10s
      timeout: 3s
      retries: 5

  caddy:
    image: caddy:2.8
    depends_on:
      - sim
    ports:
      - "80:80"
      - "443:443"
    environment:
      SITE_ADDRESS: ${SITE_ADDRESS}
      BASIC_AUTH_USER: ${BASIC_AUTH_USER}
      BASIC_AUTH_HASH: ${BASIC_AUTH_HASH}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data     # persisted TLS certificates
      - caddy_config:/config
    restart: unless-stopped

volumes:
  caddy_data:
  caddy_config: