# =============================================================================
# SocialiseIT -- Zero-Config Quickstart
# Just run: docker compose up -d
# Open: http://localhost:6754
#
# No env file needed! Secrets are auto-generated on first boot.
# Requires external network 'proxy-net' for Nginx Proxy Manager:
#   docker network create proxy-net
# For advanced config, see docker-compose.portainer.yml + stack.env.example
# =============================================================================

services:
  # ---------------------------------------------------------------------------
  # Init Container -- generates secrets on first boot, then exits
  # ---------------------------------------------------------------------------
  init:
    image: alpine:3.19
    container_name: socialiseit-init
    command: sh /docker-init.sh
    volumes:
      - ./docker-init.sh:/docker-init.sh:ro
      - secrets_data:/secrets
    restart: "no"

  # ---------------------------------------------------------------------------
  # Next.js Web Application
  # ---------------------------------------------------------------------------
  webapp:
    build:
      context: .
      dockerfile: Dockerfile
      target: webapp
    # Rebuild from the checked-out source on each deployment (cached layers reused).
    pull_policy: build
    container_name: socialiseit-webapp
    restart: unless-stopped
    networks:
      - default
      - proxy-net
    ports:
      - "6754:3000"
    environment:
      # Database (uses container defaults -- no config needed)
      - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-socialiseit}@socialiseit-postgres:5432/${POSTGRES_DB:-socialiseit}
      - POSTGRES_PRISMA_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-socialiseit}@socialiseit-postgres:5432/${POSTGRES_DB:-socialiseit}
      - POSTGRES_URL_NON_POOLING=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-socialiseit}@socialiseit-postgres:5432/${POSTGRES_DB:-socialiseit}
      # Redis
      - REDIS_URL=redis://:${REDIS_PASSWORD:-socialiseit_redis}@socialiseit-redis:6379
      # Application
      - NODE_ENV=production
      - NEXTAUTH_URL=${APP_URL:-http://localhost:6754}
      - AUTH_SECRET=${AUTH_SECRET:-}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}
      # MinIO/S3 Storage
      - S3_ENDPOINT=${S3_ENDPOINT:-http://socialiseit-minio:9000}
      - S3_ACCESS_KEY=${MINIO_ROOT_USER:-minioadmin}
      - S3_SECRET_KEY=${MINIO_ROOT_PASSWORD:-minioadmin}
      - S3_BUCKET=${S3_BUCKET:-socialiseit}
    depends_on:
      init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - uploads_data:/app/public/uploads
      - secrets_data:/secrets:ro
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:3000/api/health" ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '1.0'

  # ---------------------------------------------------------------------------
  # Background Job Worker
  # ---------------------------------------------------------------------------
  worker:
    build:
      context: .
      dockerfile: Dockerfile
      target: worker
    pull_policy: build
    container_name: socialiseit-worker
    restart: unless-stopped
    environment:
      - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-socialiseit}@socialiseit-postgres:5432/${POSTGRES_DB:-socialiseit}
      - REDIS_URL=redis://:${REDIS_PASSWORD:-socialiseit_redis}@socialiseit-redis:6379
      - NODE_ENV=production
      - APP_URL=${APP_URL:-http://localhost:6754}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}
      # ENCRYPTION_KEY also auto-loaded from /secrets/.env if not set above
    depends_on:
      init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - uploads_data:/app/public/uploads
      - secrets_data:/secrets:ro
    # Why: Video uploads load 90MB+ files into memory, 512MB is too small
    stop_grace_period: 120s

  # ---------------------------------------------------------------------------
  # PostgreSQL Database
  # ---------------------------------------------------------------------------
  postgres:
    image: postgres:16.2-alpine
    container_name: socialiseit-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-socialiseit}
      POSTGRES_DB: ${POSTGRES_DB:-socialiseit}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}" ]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '1.0'

  # ---------------------------------------------------------------------------
  # Redis for Caching and Job Queues
  # ---------------------------------------------------------------------------
  redis:
    image: redis:7.2-alpine
    container_name: socialiseit-redis
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD:-socialiseit_redis}
    volumes:
      - redis_data:/data
    healthcheck:
      test: [ "CMD-SHELL", "redis-cli -a ${REDIS_PASSWORD:-socialiseit_redis} ping | grep -q PONG" ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '0.5'

  # ---------------------------------------------------------------------------
  # MinIO S3-Compatible Object Storage
  # ---------------------------------------------------------------------------
  minio:
    image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
    container_name: socialiseit-minio
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    volumes:
      - minio_data:/data
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:9000/minio/health/live" ]
      interval: 30s
      timeout: 20s
      retries: 3

# =============================================================================
# Networks
# =============================================================================
networks:
  default:
    name: socialiseit-internal
  proxy-net:
    external: true
    # REQUIRED: Run once on server: docker network create proxy-net

# =============================================================================
# Volumes (Persistent Data)
# =============================================================================
volumes:
  secrets_data:
    name: socialiseit-secrets
  postgres_data:
    name: socialiseit-postgres-data
  redis_data:
    name: socialiseit-redis-data
  minio_data:
    name: socialiseit-minio-data
  uploads_data:
    name: socialiseit-uploads-data