services:
  leadflow:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "3000:3000"
    volumes:
      - leadflow_data:/data
    environment:
      # Database — stored in /data volume for persistence
      DATABASE_URL: file:/data/leadflow.db
      # 32-character secret for AES-256 credential encryption
      APP_ENCRYPTION_SECRET: ${APP_ENCRYPTION_SECRET:-change-me-in-production-32chars}
      NODE_ENV: production
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/credentials"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

volumes:
  leadflow_data:
    driver: local