# Shared MariaDB. Per-site databases + least-privilege users are created later by
# the provisioning CLI (Phase 4). Not published to the host — reachable only by
# containers on the internal `platform` network.
services:
  mariadb:
    image: mariadb:11.4
    container_name: mariadb
    restart: unless-stopped
    environment:
      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
      MARIADB_AUTO_UPGRADE: "1"
    volumes:
      - /tank/platform/mariadb:/var/lib/mysql
      - ./conf/99-heleos.cnf:/etc/mysql/mariadb.conf.d/99-heleos.cnf:ro
    networks:
      - platform
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 20s
      timeout: 5s
      retries: 10
    # Root is reachable only from within the container/platform net; no host port.

networks:
  platform:
    external: true