services:
  nginx:
    image: ghcr.io/trikusec/trikusec-nginx:latest
    #build:
    #  context: .
    #  dockerfile: Dockerfile.nginx
    container_name: trikusec-nginx
    volumes:
      # Commented out to use the image's default configuration
      # Uncomment to use your own configuration
      #- ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - staticfiles:/app/staticfiles:ro
      - nginx-certs:/etc/nginx/certs
    ports:
      - "8000:8000"
      - "8001:8001"
    depends_on:
      - trikusec-manager
      - trikusec-lynis-api
    restart: unless-stopped
    entrypoint: ["/bin/sh", "/docker-entrypoint-nginx.sh"]
    command: ["nginx", "-g", "daemon off;"]
    environment:
      # Domain-based configuration (automatically configures NGINX_CERT_CN)
      - TRIKUSEC_DOMAIN=${TRIKUSEC_DOMAIN}
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "https://localhost:8000/health/", "--no-check-certificate"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  trikusec-manager:
    image: ghcr.io/trikusec/trikusec-manager:latest
    #build:
    #  context: .
    #  dockerfile: Dockerfile.frontend
    container_name: trikusec-manager
    volumes:
      - frontend-certs:/app/certs
      - staticfiles:/app/staticfiles
      - trikusec-db:/app/data
    environment:
      - SECRET_KEY=${SECRET_KEY}
      # Domain-based configuration (automatically configures URLs and allowed hosts)
      - TRIKUSEC_DOMAIN=${TRIKUSEC_DOMAIN}
      - TRIKUSEC_ADMIN_PASSWORD=${TRIKUSEC_ADMIN_PASSWORD:-trikusec}
      - TZ=${TZ:-UTC}
    expose:
      - "8000"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8000/health/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  trikusec-lynis-api:
    image: ghcr.io/trikusec/trikusec-lynis-api:latest
    #build:
    #  context: .
    #  dockerfile: Dockerfile.api
    container_name: trikusec-lynis-api
    volumes:
      - api-certs:/app/certs
      - trikusec-db:/app/data
    environment:
      - SECRET_KEY=${SECRET_KEY}
      # Domain-based configuration (automatically configures URLs and allowed hosts)
      - TRIKUSEC_DOMAIN=${TRIKUSEC_DOMAIN}
      - TZ=${TZ:-UTC}
    expose:
      - "8001"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8001/health/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

volumes:
  frontend-certs:
  api-certs:
  staticfiles:
  nginx-certs:
  trikusec-db: