version: '3.8'

services:
  postgres:
    image: ghcr.io/insforge/postgres:v15.13.1
    container_name: insforge-postgres
    command: postgres -c config_file=/etc/postgresql/postgresql.conf -c app.encryption_key='${ENCRYPTION_KEY:-${JWT_SECRET:-dev-secret-please-change-in-production}}'
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-postgres}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
      - POSTGRES_DB=${POSTGRES_DB:-insforge}
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./docker-init/db/db-init.sql:/docker-entrypoint-initdb.d/01-init.sql
      - ./docker-init/db/jwt.sql:/docker-entrypoint-initdb.d/02-jwt.sql
      - ./docker-init/db/postgresql.conf:/etc/postgresql/postgresql.conf
    ports:
      - "5432:5432"
    networks:
      - insforge-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5

  postgrest:
    image: postgrest/postgrest:v12.2.12
    container_name: insforge-postgrest
    restart: unless-stopped
    environment:
      # POSTGRES_USER: ${POSTGRES_USER:-postgres}
      # POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      # POSTGRES_DB: ${POSTGRES_DB:-insforge}
      PGRST_DB_URI: postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-insforge}
      PGRST_OPENAPI_SERVER_PROXY_URI: http://localhost:3000
      PGRST_DB_SCHEMA: public
      PGRST_DB_ANON_ROLE: anon
      PGRST_JWT_SECRET: ${JWT_SECRET:-dev-secret-please-change-in-production}
      # Enable schema reloading via NOTIFY
      PGRST_DB_CHANNEL_ENABLED: true
      PGRST_DB_CHANNEL: pgrst
    ports:
      - "5430:3000"
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - insforge-network

  insforge:
    image: node:20-alpine
    container_name: insforge
    working_dir: /app
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "7130:7130"
      - "7131:7131"
      - "7132:7132"
    environment:
      - PORT=7130
      - PROJECT_ROOT=/app
      - API_BASE_URL=${API_BASE_URL:-}
      - VITE_API_BASE_URL=${VITE_API_BASE_URL:-}
      - JWT_SECRET=${JWT_SECRET:-dev-secret-please-change-in-production}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}
      - ADMIN_EMAIL=${ADMIN_EMAIL:-admin@example.com}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-change-this-password}
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-}
      # PostgreSQL connection
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_DB=${POSTGRES_DB:-insforge}
      - POSTGRES_USER=${POSTGRES_USER:-postgres}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
      - DATABASE_URL=postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-insforge}
      - POSTGREST_BASE_URL=http://postgrest:3000
      # Deno Runtime URL for serverless functions
      - DENO_RUNTIME_URL=http://deno:7133
      # Deno Subhosting Configuration
      - DENO_SUBHOSTING_TOKEN=${DENO_SUBHOSTING_TOKEN:-}
      - DENO_SUBHOSTING_ORG_ID=${DENO_SUBHOSTING_ORG_ID:-}
      # Storage Configuration
      - AWS_S3_BUCKET=${AWS_S3_BUCKET:-}
      - AWS_REGION=${AWS_REGION:-}
      - AWS_CLOUDFRONT_URL=${AWS_CLOUDFRONT_URL:-}
      - AWS_CLOUDFRONT_KEY_PAIR_ID=${AWS_CLOUDFRONT_KEY_PAIR_ID:-}
      - AWS_CLOUDFRONT_PRIVATE_KEY=${AWS_CLOUDFRONT_PRIVATE_KEY:-}
      # Multi-tenant Cloud Configuration
      - DEPLOYMENT_ID=${DEPLOYMENT_ID:-}
      - PROJECT_ID=${PROJECT_ID:-}
      - APP_KEY=${APP_KEY:-}
      - ACCESS_API_KEY=${ACCESS_API_KEY:-}
      - CLOUD_API_HOST=${CLOUD_API_HOST:-}
      # LLM Model API keys
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY:-}
      # OAuth Configuration
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID:-}
      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET:-}
      - DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID:-}
      - DISCORD_CLIENT_SECRET=${DISCORD_CLIENT_SECRET:-}
      - MICROSOFT_CLIENT_ID=${MICROSOFT_CLIENT_ID:-}
      - MICROSOFT_CLIENT_SECRET=${MICROSOFT_CLIENT_SECRET:-}
      - LINKEDIN_CLIENT_ID=${LINKEDIN_CLIENT_ID:-}
      - LINKEDIN_CLIENT_SECRET=${LINKEDIN_CLIENT_SECRET:-}
      - X_CLIENT_ID=${X_CLIENT_ID:-}
      - X_CLIENT_SECRET=${X_CLIENT_SECRET:-}
      - APPLE_CLIENT_ID=${APPLE_CLIENT_ID:-}
      - APPLE_CLIENT_SECRET=${APPLE_CLIENT_SECRET:-}
      # Logs directory
      - LOGS_DIR=/insforge-logs
      # Storage directory (for local file storage when S3 is not configured)
      - STORAGE_DIR=/insforge-storage
      # Auth app URL for development proxy
      - AUTH_APP_URL=${AUTH_APP_URL:-http://localhost:7132}
    volumes:
      - ./package.json:/app/package.json
      - ./backend:/app/backend
      - ./frontend:/app/frontend
      - ./auth:/app/auth
      - ./shared-schemas:/app/shared-schemas
      - ./docs:/app/docs
      - node_modules:/app/node_modules
      - backend_node_modules:/app/backend/node_modules
      - frontend_node_modules:/app/frontend/node_modules
      - auth_node_modules:/app/auth/node_modules
      - shared_schemas_node_modules:/app/shared-schemas/node_modules
      - shared-logs:/insforge-logs
      - storage-data:/insforge-storage
    command: sh -c "npm install && cd backend && npm run migrate:up && cd .. && npm run dev"
    restart: unless-stopped
    networks:
      - insforge-network

  # Deno serverless runtime for edge functions
  deno:
    image: denoland/deno:alpine-2.0.6
    container_name: insforge-deno
    working_dir: /app
    depends_on:
      - postgres
      - postgrest
    ports:
      - "7133:7133"
    environment:
      - PORT=7133
      - DENO_ENV=${DENO_ENV:-development}
      - DENO_DIR=/deno-dir
      # PostgreSQL connection
      - POSTGRES_HOST=postgres
      - POSTGRES_PORT=5432
      - POSTGRES_DB=${POSTGRES_DB:-insforge}
      - POSTGRES_USER=${POSTGRES_USER:-postgres}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
      - POSTGREST_BASE_URL=http://postgrest:3000
      # Worker timeout (60 seconds default)
      - WORKER_TIMEOUT_MS=${WORKER_TIMEOUT_MS:-60000}
      # Encryption keys for decrypting function secrets
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - JWT_SECRET=${JWT_SECRET:-dev-secret-please-change-in-production}
    volumes:
      - ./functions:/app/functions
      - deno_cache:/deno-dir
    command: >
      sh -c "
        echo 'Downloading Deno dependencies...' &&
        deno cache functions/server.ts &&
        echo 'Starting Deno server on port 7133...' &&
        deno run --allow-net --allow-env --allow-read=./functions/worker-template.js --watch functions/server.ts
      "
    restart: unless-stopped
    networks:
      - insforge-network

  # Vector.dev for log collection and shipping
  vector:
    container_name: insforge-vector
    image: timberio/vector:0.28.1-alpine
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      postgrest:
        condition: service_started
      insforge:
        condition: service_started
      deno:
        condition: service_started
    volumes:
      - ./docker-init/logs/vector.yml:/etc/vector/vector.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - shared-logs:/insforge-logs
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:7135/health"]
      timeout: 5s
      interval: 5s
      retries: 3
    environment:
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY:-}
      - AWS_REGION=${AWS_REGION:-skip}
      - PROJECT_ID=${PROJECT_ID:-}
      - HOSTNAME_OVERRIDE=${HOSTNAME_OVERRIDE:-}
    command: ["--config", "/etc/vector/vector.yml"]
    networks:
      - insforge-network

volumes:
  postgres-data:
    driver: local
  node_modules:
    driver: local
  backend_node_modules:
    driver: local
  frontend_node_modules:
    driver: local
  auth_node_modules:
    driver: local
  shared_schemas_node_modules:
    driver: local
  deno_cache:
    driver: local
  shared-logs:
    driver: local
  storage-data:
    driver: local

networks:
  insforge-network:
    driver: bridge