version: '3.8'
services:
  aps-ui:
    build:
      context: /volume1/social_media_bridge/aps-ui
      dockerfile: Dockerfile
    image: aps-ui:latest
    container_name: aps-ui
    restart: unless-stopped
    # WHAT: Share the NAS host network stack instead of using Docker bridge networking
    # WHY: Lets the container reach DSM on localhost:5000 directly, bypassing any
    #      bridge routing or firewall rules that block Docker → DSM connections.
    #      With host networking the app is accessible at NAS_IP:3001 (WEB_PORT).
    network_mode: host
    env_file:
      - /volume1/social_media_bridge/aps-ui/.env
    environment:
      SYNOLOGY_NAS_ROOT: /media
      UI_SLUG_MAP_PATH: /run/ui-slug-map.json
      # WHAT: Base path under which nginx proxies the app inside DSM
      # WHY: All HTML links in EJS views are prefixed with this so they resolve
      #      correctly when served at /webman/3rdparty/APSDashboard/
      #      nginx handles redirect rewriting automatically via proxy_redirect.
      APP_BASE_PATH: /webman/3rdparty/APSDashboard
    volumes:
      - /volume1/social_media_bridge:/media:rw
      - /volume1/social_media_bridge/aps-ui/ui-slug-map.json:/run/ui-slug-map.json:ro
      # WHAT: Bind-mount Synology's session-validation binary into the container
      # WHY: authenticate.cgi reads DSM's session store directly — no HTTP round-trip,
      #      no IP binding issues. This is Synology's official way for packages to
      #      validate DSM sessions without a separate login form.
      - /usr/syno/synoman/webman/authenticate.cgi:/usr/syno/authenticate.cgi:ro
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3001/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
