# Portainer Stack Definition for School Compare — UNLEASH (feature flags)
#
# Deploy as a *separate* Portainer stack ("schoolcompare-unleash"), alongside
# the production and staging stacks. It deliberately belongs to neither: a
# staging redeploy must not be able to disturb production's flag state, and a
# production redeploy must not disturb staging's.
#
# One instance serves both environments. Open-source Unleash ships with
# `development` and `production` environments and environment-scoped client
# tokens, so the same flag holds independent state in each — which is what
# lets a feature be on in staging, where the E2E journeys exercise it, while
# production stays dark.
#
# Portainer environment variables (set in Portainer UI -> Stack -> Environment):
#   UNLEASH_DB_PASSWORD    — PostgreSQL password for the Unleash database
#   UNLEASH_ADMIN_PASSWORD — initial admin password for the Unleash UI
#   UNLEASH_IP             — macvlan IP for the Unleash server (default 10.0.1.152)

services:

  # ── PostgreSQL (Unleash's own; nothing else uses it) ──────────────────
  unleash_db:
    container_name: sc_unleash_postgres
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: unleash
      POSTGRES_PASSWORD: ${UNLEASH_DB_PASSWORD}
      POSTGRES_DB: unleash
    volumes:
      - unleash_postgres_data:/var/lib/postgresql/data
    networks:
      - unleash
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U unleash"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    restart: unless-stopped

  # ── Unleash server (UI + client API on 4242) ──────────────────────────
  unleash:
    container_name: sc_unleash
    image: unleashorg/unleash-server:6
    environment:
      DATABASE_URL: postgres://unleash:${UNLEASH_DB_PASSWORD}@unleash_db:5432/unleash
      DATABASE_SSL: "false"
      INIT_ADMIN_API_TOKENS: ""
      UNLEASH_DEFAULT_ADMIN_PASSWORD: ${UNLEASH_ADMIN_PASSWORD}
    depends_on:
      unleash_db:
        condition: service_healthy
    networks:
      unleash: {}
      macvlan:
        ipv4_address: ${UNLEASH_IP:-10.0.1.152}
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:4242/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    restart: unless-stopped

networks:
  unleash:
    driver: bridge
  macvlan:
    external:
      name: macvlan

volumes:
  unleash_postgres_data: