# A clean WordPress for the TLIG theme.
#
# Deliberately NOT the wp-migrate rig. That one bind-mounts the production tree
# — Avada, 55 plugins, a 1.5 GB database — and exists to mirror what ships. This
# one boots in seconds with nothing but core, so the theme has to stand on its
# own. Keep both: the other is the reference to compare against.
name: tlig-theme

services:
  db:
    image: mysql:8.4
    command: ["--mysql-native-password=ON"]
    environment:
      MYSQL_DATABASE: tlig
      MYSQL_USER: tlig
      MYSQL_PASSWORD: tlig
      MYSQL_ROOT_PASSWORD: tlig
    volumes:
      - db:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-ptlig"]
      interval: 5s
      timeout: 5s
      retries: 20

  wp:
    image: wordpress:php8.3-apache
    # Skip the image's core-unpacking entrypoint: core is already on disk in
    # site/, extracted from this same image so the versions cannot drift. The
    # entrypoint would otherwise try to chmod a bind mount it does not own.
    entrypoint: ["apache2-foreground"]
    # Fedora runs SELinux enforcing, which blocks container access to bind
    # mounts — including, silently, the config files below, which is why Apache
    # kept binding port 80 despite a mounted ports.conf.
    security_opt:
      - label=disable
    # Rootless podman maps the host user to container root by default, but
    # Apache refuses to run workers as root. keep-id maps host uid 1000 to
    # container uid 1000, so the container process is literally the owner of the
    # bind-mounted tree. Under rootful docker, drop this and set RUN_UID=1000.
    userns_mode: "keep-id"
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "8090:8080"
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_NAME: tlig
      WORDPRESS_DB_USER: tlig
      WORDPRESS_DB_PASSWORD: tlig
      WORDPRESS_DEBUG: "1"
      WORDPRESS_CONFIG_EXTRA: |
        define( 'WP_DEBUG_DISPLAY', true );
        define( 'SCRIPT_DEBUG', true );
        define( 'DISALLOW_FILE_EDIT', true );
    # The project's own site/ is the docroot, so a Vite build lands in the
    # running theme immediately — no copy step, no container restart. Config is
    # mounted over the top, so site/ never holds environment-specific settings.
    volumes:
      - ../site:/var/www/html
      - ./wp-config.php:/var/www/html/wp-config.php:ro
      - ./apache-ports.conf:/etc/apache2/ports.conf:ro
      - ./apache-vhost.conf:/etc/apache2/sites-enabled/000-default.conf:ro
      - ./apache-local.conf:/etc/apache2/conf-enabled/zz-local.conf:ro
    user: "${RUN_UID:-1000}:${RUN_GID:-1000}"

  cli:
    image: wordpress:cli-php8.3
    security_opt:
      - label=disable
    userns_mode: "keep-id"
    depends_on:
      db:
        condition: service_healthy
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_NAME: tlig
      WORDPRESS_DB_USER: tlig
      WORDPRESS_DB_PASSWORD: tlig
    volumes:
      - ../site:/var/www/html
      - ./wp-config.php:/var/www/html/wp-config.php:ro
    user: "${RUN_UID:-1000}:${RUN_GID:-1000}"
    profiles: ["cli"]

volumes:
  db: