services:
  backend:
    build:
      context: .
      dockerfile: apps/backend/Dockerfile
    ports:
      - "3000:3000"
    volumes:
      - ./apps/backend/src:/app/apps/backend/src:z
      - ./test-data/media:/app/media:z
      - ./player-applications:/app/apps/backend/player-applications:ro,z
    environment:
      - DATABASE_URL=postgres://mynextscreen:mynextscreen@postgres:5432/mynextscreen
      - REDIS_URL=redis://redis:6379
      - MEDIA_BASE_PATH=/app/media
      - MAX_FILE_SIZE_BYTES=1073741824
      - FFMPEG_VIDEO_CRF=18
      - FFMPEG_VIDEO_PRESET=slow
      - FFMPEG_VIDEO_MAXRATE=8M
      - FFMPEG_VIDEO_BUFSIZE=16M
      - JWT_ACCESS_SECRET=${JWT_ACCESS_SECRET:-dev-insecure-secret-change-me-before-production}
      # Well-known DEV key (32 bytes, base64) — never use in production.
      - SECRETS_ENCRYPTION_KEY=${SECRETS_ENCRYPTION_KEY:-ZGV2LWluc2VjdXJlLWtleS1jaGFuZ2UtbWUtMzJieXQ=}
      - JWT_ACCESS_TTL=${JWT_ACCESS_TTL:-15m}
      - JWT_REFRESH_TTL=${JWT_REFRESH_TTL:-30d}
      - COOKIE_SECURE=${COOKIE_SECURE:-false}
      - COOKIE_SAMESITE=${COOKIE_SAMESITE:-strict}
      - PUBLIC_BASE_URL=${PUBLIC_BASE_URL:-http://localhost:4200}
      # Player app origin — allowed for CORS (pairing + screen-auth requests).
      - PLAYER_BASE_URL=${PLAYER_BASE_URL:-http://localhost:4300}
      # Platform mailer → Mailpit in dev (catch-all, no auth). View at http://localhost:8025
      - SMTP_HOST=${SMTP_HOST:-mailpit}
      - SMTP_PORT=${SMTP_PORT:-1025}
      - SMTP_SECURE=${SMTP_SECURE:-false}
      - SMTP_FROM=${SMTP_FROM:-myNextScreen <noreply@mynextscreen.local>}
      - SIGNUP_ENABLED=${SIGNUP_ENABLED:-true}
      # Prometheus scrape endpoint /api/metrics; empty keeps it disabled (404).
      - METRICS_SCRAPE_TOKEN=${METRICS_SCRAPE_TOKEN:-}
    depends_on:
      - redis
      - postgres
      - mailpit

  frontend:
    build:
      context: .
      dockerfile: apps/frontend/Dockerfile
    ports:
      - "4200:4200"
    volumes:
      - ./apps/frontend/src:/app/apps/frontend/src:z
      # Shared wire types (@mynextscreen/shared-types): without this mount the dev
      # server keeps the copy baked into the image and fails on new types.
      - ./libs/shared-types/src:/app/libs/shared-types/src:z
      - ./apps/frontend/proxy.conf.docker.json:/app/apps/frontend/proxy.conf.docker.json:z

  player:
    build:
      context: .
      dockerfile: apps/player/Dockerfile
    ports:
      - "4300:4300"
    volumes:
      - ./apps/player/src:/app/apps/player/src:z
      - ./apps/player/proxy.conf.docker.json:/app/apps/player/proxy.conf.docker.json:z

  redis:
    image: docker.io/library/redis:7-alpine
    ports:
      # Loopback only: an unauthenticated Redis on 0.0.0.0 is reachable from
      # the whole network, and it holds the refresh tokens.
      - "127.0.0.1:6379:6379"

  mailpit:
    image: docker.io/axllent/mailpit
    ports:
      # Loopback only: an open relay and every captured mail otherwise.
      - "127.0.0.1:1025:1025" # SMTP ingest
      - "127.0.0.1:8025:8025" # web UI
    environment:
      - MP_MAX_MESSAGES=500

  postgres:
    image: docker.io/library/postgres:16-alpine
    ports:
      # Loopback only: the dev database has the default password.
      - "127.0.0.1:5432:5432"
    environment:
      - POSTGRES_USER=mynextscreen
      - POSTGRES_PASSWORD=mynextscreen
      - POSTGRES_DB=mynextscreen
    volumes:
      - mynextscreen-postgres-data:/var/lib/postgresql/data

volumes:
  mynextscreen-postgres-data: