services:
  # Public website served via nginx
  website:
    image: nginx:1.29-alpine
    container_name: way-cms-website
    ports:
      - "${WEBSITE_PORT:-8080}:80"
    volumes:
      # Single-tenant: website files
      - ${WEBSITE_DIR:-./website}:/usr/share/nginx/html:ro
      # Multi-tenant: project-specific website (override WEBSITE_DIR per project)
      - ${PROJECTS_DIR:-./projects}:/var/www/projects:ro
      # Nginx configuration
      - ${NGINX_CONF_DIR:-./nginx}/nginx.conf:/etc/nginx/nginx.conf:ro
      - ${NGINX_CONF_DIR:-./nginx}/default.conf:/etc/nginx/conf.d/default.conf:ro
    restart: unless-stopped
    networks:
      - way-cms-network

  # CMS admin interface
  cms:
    build:
      context: ./cms
      dockerfile: Dockerfile
    container_name: way-cms-admin
    ports:
      - "${CMS_PORT:-5001}:5000"
    # Override CMD for development - use Flask dev server
    # In production, use the pinned Docker Hub image (see docker-compose.prod.yml)
    command: python app.py
    volumes:
      # Single-tenant: website files
      - ${WEBSITE_DIR:-./website}:/var/www/html:rw
      # Backups directory (project-specific backups go here: BACKUP_DIR/project-slug/auto/)
      - ${BACKUP_DIR:-./.way-cms-backups}:/.way-cms-backups:rw
      # Multi-tenant: SQLite database and settings
      - ${DATA_DIR:-./.way-cms-data}:/.way-cms-data:rw
      # Multi-tenant: all projects (only used when MULTI_TENANT=true)
      - ${PROJECTS_DIR:-./projects}:/var/www/projects:rw
    environment:
      # ============== Single-Tenant Mode (Default) ==============
      # Base directory for website files
      - CMS_BASE_DIR=/var/www/html
      
      # Authentication (use either CMS_PASSWORD or CMS_PASSWORD_HASH)
      - CMS_USERNAME=${CMS_USERNAME:-admin}
      - CMS_PASSWORD=${CMS_PASSWORD:-admin}
      - CMS_PASSWORD_HASH=${CMS_PASSWORD_HASH:-}
      
      # ============== Multi-Tenant Mode ==============
      # Set MULTI_TENANT=true to enable multi-tenant mode
      - MULTI_TENANT=${MULTI_TENANT:-false}
      
      # Multi-tenant directories (only used when MULTI_TENANT=true)
      - DATA_DIR=${DATA_DIR:-/.way-cms-data}
      - PROJECTS_BASE_DIR=${PROJECTS_BASE_DIR:-/var/www/projects}
      
      # Initial admin user (required for first run in multi-tenant mode)
      - ADMIN_EMAIL=${ADMIN_EMAIL:-}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
      
      # Email configuration for magic links (multi-tenant)
      - SMTP_HOST=${SMTP_HOST:-}
      - SMTP_PORT=${SMTP_PORT:-587}
      # Note: Port 465 uses SSL (set SMTP_USE_TLS=false), Port 587 uses TLS (set SMTP_USE_TLS=true)
      # If SMTP_USE_TLS is not set, it auto-detects: 465=false, 587=true
      - SMTP_USER=${SMTP_USER:-}
      - SMTP_PASSWORD=${SMTP_PASSWORD:-}
      - SMTP_FROM=${SMTP_FROM:-}
      - SMTP_FROM_NAME=${SMTP_FROM_NAME:-Way-CMS}
      - SMTP_USE_TLS=${SMTP_USE_TLS:-}
      - MAGIC_LINK_EXPIRY_HOURS=${MAGIC_LINK_EXPIRY_HOURS:-24}
      - APP_URL=${APP_URL:-http://localhost:5001}
      
      # ============== Common Settings ==============
      # Security
      - SECRET_KEY=${SECRET_KEY:-change-me-in-production-please}
      - READ_ONLY_MODE=${READ_ONLY_MODE:-false}
      
      # Session configuration (in minutes, default 24 hours)
      - SESSION_TIMEOUT_MINUTES=${SESSION_TIMEOUT_MINUTES:-1440}
      
      # Website display settings (single-tenant only)
      - WEBSITE_URL=${WEBSITE_URL:-}
      - WEBSITE_NAME=${WEBSITE_NAME:-}
      
      # Backup directory (default: /.way-cms-backups)
      - BACKUP_DIR=${BACKUP_DIR:-/.way-cms-backups}
      
      # Automatic backups (enabled by default)
      - AUTO_BACKUP_ENABLED=${AUTO_BACKUP_ENABLED:-true}
      
      # Flask configuration
      - PORT=5000
      - FLASK_APP=app.py
    restart: unless-stopped
    networks:
      - way-cms-network
    depends_on:
      - website

networks:
  way-cms-network:
    driver: bridge

volumes:
  website-data:
    driver: local