# koopa-paivana — host :9025 → Caddy paivana.hacktivism.ch
# Live: /home/hernani/koopa-paivana/
services:
  paivana:
    build:
      context: .
      dockerfile: Containerfile
    image: localhost/koopa-paivana:latest
    container_name: koopa-paivana
    restart: unless-stopped
    # Image already USER paivana-httpd; pin numeric + keep-id for host secrets/volumes.
    user: "1000:1000"
    userns_mode: keep-id
    ports:
      - "9025:9967"
    extra_hosts:
      - "taler.hacktivism.ch:host-gateway"
      - "bank.hacktivism.ch:host-gateway"
      - "exchange.hacktivism.ch:host-gateway"
    volumes:
      - ./conf/paivana.conf.template:/etc/paivana/paivana.conf.template:ro
      - ./entrypoint.sh:/usr/local/bin/paivana-entrypoint:ro
      - ./secrets/merchant-access-token:/run/secrets/merchant-access-token:ro
      - ./secrets/paivana-secret:/run/secrets/paivana-secret:ro
    depends_on:
      - upstream
    labels:
      org.hacktivism.service: paivana
      org.hacktivism.host_port: "9025"
      org.hacktivism.site: paivana.hacktivism.ch
      org.hacktivism.managed_by: koopa-admin
      org.hacktivism.currency: GOA

  upstream:
    # Non-root nginx (listens on 8080). See DESTINATION_BASE_URL in conf template.
    image: docker.io/nginxinc/nginx-unprivileged:1.27-alpine
    container_name: koopa-paivana-upstream
    restart: unless-stopped
    volumes:
      - ./upstream:/usr/share/nginx/html:ro
    expose:
      - "8080"
    command: ["nginx", "-g", "daemon off;"]
    labels:
      org.hacktivism.service: paivana-upstream
      org.hacktivism.managed_by: koopa-admin