services:
  # PostgreSQL Database
  postgres:
    image: pgvector/pgvector:pg16
    container_name: ownpilot-postgres
    restart: unless-stopped
    ports:
      # Bind to IPv4 loopback only — avoids localhost/::1 resolution issues on Windows
      # and prevents exposing the DB to other hosts on the LAN.
      - '127.0.0.1:${POSTGRES_PORT:-25432}:5432'
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-ownpilot}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB:-ownpilot}
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./packages/gateway/src/db/migrations/postgres:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER:-ownpilot} -d ${POSTGRES_DB:-ownpilot}']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - ownpilot-network
    profiles:
      - postgres

  # OwnPilot (API + UI in a single container)
  # To use pre-built image instead of local build:
  # image: ghcr.io/ownpilot/ownpilot:latest
  gateway:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: ownpilot
    restart: unless-stopped
    ports:
      - '${PORT:-8080}:8080'
    environment:
      - NODE_ENV=production
      - PORT=8080
      - HOST=0.0.0.0
      - OWNPILOT_DATA_DIR=/app/data
      # Database (always connects to the postgres service inside Docker network)
      - DATABASE_URL=${DATABASE_URL:-}
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_USER=${POSTGRES_USER:-ownpilot}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB:-ownpilot}
      # Telegram
      - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN:-}
      # Auth & Security
      - AUTH_TYPE=${AUTH_TYPE:-none}
      - API_KEYS=${API_KEYS:-}
      - JWT_SECRET=${JWT_SECRET:-}
      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:8199}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}
      # Rate Limiting
      - RATE_LIMIT_DISABLED=${RATE_LIMIT_DISABLED:-false}
      - RATE_LIMIT_WINDOW_MS=${RATE_LIMIT_WINDOW_MS:-60000}
      - RATE_LIMIT_MAX=${RATE_LIMIT_MAX:-500}
      # MQTT (Edge Delegation)
      - MQTT_BROKER_URL=${MQTT_BROKER_URL:-}
      # Logging
      - LOG_LEVEL=${LOG_LEVEL:-info}
    volumes:
      - gateway-data:/app/data
    healthcheck:
      test: ['CMD', 'wget', '--no-verbose', '--tries=1', '--spider', 'http://127.0.0.1:8080/health']
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    networks:
      - ownpilot-network
    depends_on:
      postgres:
        condition: service_healthy
        required: false

  # Eclipse Mosquitto MQTT Broker (for Edge Delegation)
  mosquitto:
    image: eclipse-mosquitto:2
    container_name: ownpilot-mosquitto
    restart: unless-stopped
    ports:
      # SECURITY (DOCK-004/IAC-002): bind to IPv4 loopback only. The broker
      # ships with allow_anonymous=true, so exposing these ports on 0.0.0.0
      # would give any host on the LAN full read/write on all MQTT topics
      # (including edge-device control + agent messaging). Other containers
      # still reach the broker over the compose network by service name.
      - '127.0.0.1:${MQTT_PORT:-1883}:1883'
      - '127.0.0.1:${MQTT_WS_PORT:-9001}:9001'
    volumes:
      - ./packages/gateway/docker/mosquitto/config:/mosquitto/config:ro
      - mosquitto-data:/mosquitto/data
      - mosquitto-log:/mosquitto/log
    networks:
      - ownpilot-network
    profiles:
      - mqtt

volumes:
  gateway-data:
    driver: local
  postgres-data:
    driver: local
  mosquitto-data:
    driver: local
  mosquitto-log:
    driver: local

networks:
  ownpilot-network:
    driver: bridge