# Public "Live demo" override. Layer on the base to run a single ROLE=all box in
# demo mode, with no login; explicit sensitive routes locked; notifier dispatch
# suppressed; and boot refused for a live-mode account. Interactive trading
# remains available on Binance testnet:
#
#   docker compose -f deploy/compose/docker-compose.yml \
#     -f deploy/compose/docker-compose.demo.yml up
#
# This is a SEPARATE deployment (its own container + DB), never the operator's
# real instance. It runs against Binance TESTNET only: the box holds a testnet
# key pair (seeded via a pg_restore of a golden snapshot at deploy — a deploy
# secret, never committed), so visitors place real testnet orders with fake
# money. "No sensitive info exposed" holds by construction: only a testnet key is
# ever present and credential, notifier, backup/restore, account-creation,
# account-rename/delete, retention-change, diagnosis-start, fee-reconciliation, and
# archive-backfill routes are off.
#
# Operator deployment checklist:
#   - Seed the golden testnet snapshot (account + profiles + symbols + history).
#   - Add app/proxy rate limiting on the public endpoint (no login = no throttle).
#   - Nightly reset job that re-restores the snapshot (calls restore logic
#     directly — the /restore route is locked in demo mode).

services:
  app:
    environment:
      # The single switch. Parsed strictly: only '1'/'true' enable it.
      LIVE_DEMO: '1'
      # Public origin the demo SPA is served from. Replace with the real host.
      WEB_ORIGIN: ${WEB_ORIGIN:-https://demo.example.com}
      NODE_ENV: ${NODE_ENV:-production}