# Walled-store subsystem — run on a HOME box (residential IP), reach it from the phone
# via Tailscale (host runs tailscaled) or home LAN. Ports bind to ALL host interfaces:
# acceptable because the box sits behind the home router's NAT + Tailscale — but this
# container holds a LIVE PASSWORDLESS BROWSER SESSION (x11vnc -nopw), so NEVER port-forward
# 3000/8090 through the router to the public internet. See WALLED-STORES.md.
services:
  comparator:
    build:
      context: ..
      dockerfile: docker/Dockerfile
    ports:
      - "3000:3000" # the app — LAN + tailnet
      - "8090:8080" # noVNC — challenge-solving stream (host 8080 is already taken on the home box)
    volumes:
      - chrome-profile:/data/chrome-profile # persists cf_clearance so the session stays warm
      - comparator-data:/app/data # SQLite: response cache + measurement (searches/clickouts)
    environment:
      - BROWSER_URL=http://127.0.0.1:9222
      # HOST-side address the solve view opens at. LAN IP works on home Wi-Fi; from the
      # tailnet use http://100.82.172.121:8090 instead. Slice 4 should rewrite the host part
      # to window.location.hostname in the frontend so one URL serves both.
      - NOVNC_URL=http://10.82.82.1:8090/vnc.html?autoconnect=1
    shm_size: "1gb" # Chrome needs more than the default 64MB
    restart: unless-stopped

volumes:
  chrome-profile:
  comparator-data:
