services:
  app:
    build:
      context: .
      args:
        # NEXT_PUBLIC_* vars are inlined into the browser bundle at build
        # time, so they have to be passed here, not just in env_file below.
        NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
    restart: unless-stopped
    ports:
      - "3000:3000"
    env_file:
      - .env

  # Replaces the Vercel Cron job from vercel.json (not available outside
  # Vercel): calls the same endpoint on the same daily schedule using the
  # same bearer-secret auth the route already expects.
  cron:
    image: alpine:3.20
    restart: unless-stopped
    depends_on:
      app:
        condition: service_healthy
    env_file:
      - .env
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        echo "0 3 * * * /bin/sh -c 'wget -q -O- --header=\"Authorization: Bearer \$$CRON_SECRET\" http://app:3000/api/cron/apply-pending-changes >> /var/log/cron.log 2>&1'" > /etc/crontabs/root
        crond -f -d 8