services:
  # OpenFGA Authorization Server
  openfga:
    image: openfga/openfga:latest
    container_name: openfga
    command: run
    environment:
      - OPENFGA_DATASTORE_ENGINE=postgres
      - OPENFGA_DATASTORE_URI=postgres://openfga:openfga@postgres:5432/openfga?sslmode=disable
      - OPENFGA_PLAYGROUND_ENABLED=true
    ports:
      - "8080:8080"
      - "8081:8081"
      - "3000:3000"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/healthz"]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - authz-network

  # PostgreSQL for OpenFGA
  postgres:
    image: postgres:15-alpine
    container_name: postgres
    environment:
      - POSTGRES_USER=openfga
      - POSTGRES_PASSWORD=openfga
      - POSTGRES_DB=openfga
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U openfga"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - authz-network

  # Authorization Gateway
  gateway:
    build:
      context: ./gateway
      dockerfile: Dockerfile
    container_name: authz-gateway
    environment:
      - OPENFGA_API_URL=http://openfga:8080
      - OPENFGA_STORE_ID=${OPENFGA_STORE_ID:-}
      - OPENFGA_MODEL_ID=${OPENFGA_MODEL_ID:-}
      - MOCK_MODE=${MOCK_MODE:-true}
      - PORT=9000
      - LOG_LEVEL=debug
    ports:
      - "9000:9000"
    depends_on:
      openfga:
        condition: service_healthy
    networks:
      - authz-network

volumes:
  postgres_data:

networks:
  authz-network:
    driver: bridge