services:
  # Generates machine secrets (JWT/DB/Redis) on first run when they aren't set
  # in .env (seeds from the env var when provided, else a random value).
  # Idempotent — never overwrites an existing file. See docker-compose.production.yml.
  secrets-init:
    image: alpine:3.20
    container_name: picpeak-secrets-init
    env_file: .env
    entrypoint:
      - sh
      - -c
      - |
        set -e
        mkdir -p /run/secrets
        if [ ! -s /run/secrets/jwt_secret ]; then
          if [ -n "$$JWT_SECRET" ]; then printf '%s' "$$JWT_SECRET" > /run/secrets/jwt_secret;
          else tr -dc A-Za-z0-9 < /dev/urandom | head -c 48 > /run/secrets/jwt_secret; fi
        fi
        if [ ! -s /run/secrets/db_password ]; then
          if [ -n "$$DB_PASSWORD" ]; then printf '%s' "$$DB_PASSWORD" > /run/secrets/db_password;
          else tr -dc A-Za-z0-9 < /dev/urandom | head -c 48 > /run/secrets/db_password; fi
        fi
        if [ ! -s /run/secrets/redis_password ]; then
          if [ -n "$$REDIS_PASSWORD" ]; then printf '%s' "$$REDIS_PASSWORD" > /run/secrets/redis_password;
          else tr -dc A-Za-z0-9 < /dev/urandom | head -c 48 > /run/secrets/redis_password; fi
        fi
        if [ -n "$$BACKUP_MANIFEST_KEY" ]; then
          # A corrected BACKUP_MANIFEST_KEY replaces the seeded copy, so a bad
          # first value is not sticky. The value it replaces is kept, one per
          # line, for BACKUP_MANIFEST_KEYS_OLD.
          if [ "$$(cat /run/secrets/backup_manifest_key 2>/dev/null)" != "$$BACKUP_MANIFEST_KEY" ]; then
            if [ -s /run/secrets/backup_manifest_key ]; then
              { cat /run/secrets/backup_manifest_key; echo; } >> /run/secrets/backup_manifest_key.previous
              chmod 600 /run/secrets/backup_manifest_key.previous
            fi
            printf '%s' "$$BACKUP_MANIFEST_KEY" > /run/secrets/backup_manifest_key
          fi
        elif [ ! -e /run/secrets/backup_manifest_key ]; then
          od -An -N32 -tx1 /dev/urandom | tr -d ' \n' > /run/secrets/backup_manifest_key
        fi
        # Independent backup-store trust anchor: backend volume only, never
        # copied into Postgres/Redis secrets or the backed-up media estate.
        chmod 644 /run/secrets/backup_manifest_key
        # 644: the readers run as three different users (postgres, redis, nodejs),
        # so a non-root reader must be able to read them. The volume is private to
        # these containers and never host-exposed.
        chmod 644 /run/secrets/jwt_secret /run/secrets/db_password /run/secrets/redis_password
        # Postgres and Redis each mount a volume holding only their own password,
        # so neither can read jwt_secret (the backend's token signing key).
        # Refreshed from picpeak-secrets on every run, which also fills them on
        # an existing install the first time this version starts.
        mkdir -p /run/db-secret /run/redis-secret
        cp /run/secrets/db_password /run/db-secret/db_password
        cp /run/secrets/redis_password /run/redis-secret/redis_password
        chmod 644 /run/db-secret/db_password /run/redis-secret/redis_password
    volumes:
      - picpeak-secrets:/run/secrets
      - picpeak-db-secret:/run/db-secret
      - picpeak-redis-secret:/run/redis-secret
    restart: "no"

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: picpeak-backend
    restart: unless-stopped
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      - PORT=3000
      # Trust exactly the immediately connected frontend nginx hop. Trusting
      # all private ranges lets a LAN client extend and spoof the XFF chain.
      # A reverse proxy on the host in front of the frontend makes it 2.
      - TRUST_PROXY=${TRUST_PROXY:-1}
      - COOKIE_SECURE=${COOKIE_SECURE:-auto}
      - ENABLE_HSTS=${ENABLE_HSTS:-false}
      - JWT_SECRET=${JWT_SECRET:-}
      - BACKUP_MANIFEST_KEY=${BACKUP_MANIFEST_KEY:-}
      - BACKUP_MANIFEST_KEY_FILE=${BACKUP_MANIFEST_KEY_FILE:-/run/secrets/backup_manifest_key}
      - BACKUP_MANIFEST_KEYS_OLD=${BACKUP_MANIFEST_KEYS_OLD:-}
      - BACKUP_MANIFEST_LEGACY_KEY=${BACKUP_MANIFEST_LEGACY_KEY:-}
      - BACKUP_MANIFEST_RECOVERY_SHA256=${BACKUP_MANIFEST_RECOVERY_SHA256:-}
      - BACKUP_MANIFEST_RECOVERY_REASON=${BACKUP_MANIFEST_RECOVERY_REASON:-}
      - EMAIL_QUEUE_ENCRYPTION_KEY=${EMAIL_QUEUE_ENCRYPTION_KEY:-}
      - ADMIN_USERNAME=${ADMIN_USERNAME:-admin}
      - ADMIN_EMAIL=${ADMIN_EMAIL:-admin@example.com}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
      # How long a gallery guest stays recognised (#1210). Unset = 30d.
      # Listed explicitly because this service takes an environment list, so a
      # value in .env that is not named here never reaches the container.
      - GUEST_TOKEN_TTL=${GUEST_TOKEN_TTL:-}
      - DATABASE_CLIENT=pg
      - DB_TYPE=postgresql
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_USER=${DB_USER}
      - DB_PASSWORD=${DB_PASSWORD:-}
      - DB_NAME=${DB_NAME}
      - DB_SSL=${DB_SSL:-false}
      - DB_SSL_CA=${DB_SSL_CA:-}
      - DB_SSL_REJECT_UNAUTHORIZED=${DB_SSL_REJECT_UNAUTHORIZED:-}
      - DB_SSL_SERVERNAME=${DB_SSL_SERVERNAME:-}
      - EXTERNAL_MEDIA_ROOT=${EXTERNAL_MEDIA_ROOT:-/app/storage/external-media}
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT}
      - SMTP_SECURE=${SMTP_SECURE:-false}
      - SMTP_USER=${SMTP_USER}
      - SMTP_PASS=${SMTP_PASS}
      - MAIL_PRIVATE_ENDPOINTS=${MAIL_PRIVATE_ENDPOINTS:-}
      - EMAIL_FROM=${EMAIL_FROM:-noreply@picpeak.local}
      # Webhook email transport (#1225). Listed here because this service
      # declares an explicit `environment:` block — a variable only present in
      # .env is NOT passed through, so without these three the documented
      # "uncomment in .env and restart" flow silently leaves the transport off.
      - EMAIL_WEBHOOK_URL=${EMAIL_WEBHOOK_URL:-}
      - EMAIL_WEBHOOK_SECRET=${EMAIL_WEBHOOK_SECRET:-}
      - EMAIL_WEBHOOK_ALLOW_PRIVATE_URLS=${EMAIL_WEBHOOK_ALLOW_PRIVATE_URLS:-false}
      # Unset by default (#705): an injected value would always win over the
      # `general_site_url` admin setting, so the setup wizard could never
      # take effect. Set this only to pin the origin from config-as-code.
      - FRONTEND_URL=${FRONTEND_URL:-}
      # Public API origin for split-origin deployments (#798 SSO redirect_uri).
      # Empty = same origin as FRONTEND_URL (the standard proxied setup).
      - API_URL=${API_URL:-}
      # OIDC SSO (#798): key for the client secret at rest (falls back to
      # JWT_SECRET) and the break-glass override that re-enables local
      # password login when the IdP is down while SSO-only mode is active.
      - OIDC_ENCRYPTION_KEY=${OIDC_ENCRYPTION_KEY:-}
      # Signing evidence key (#1446): encrypts contract signers' names, email
      # addresses and IP addresses at rest. Unset, a key is generated into
      # storage/business-docs/keys/evidence.key — inside the backup path, but
      # then the only copy. See docs/ENVIRONMENT_VARIABLES.md.
      - PICPEAK_EVIDENCE_KEY=${PICPEAK_EVIDENCE_KEY:-}
      # Earlier evidence keys, only while rotating (scripts/rotate-evidence-key.js).
      - PICPEAK_EVIDENCE_KEYS_OLD=${PICPEAK_EVIDENCE_KEYS_OLD:-}
      # Optional product usage (#1110); remains off until explicit in-app consent.
      - USAGE_COLLECTOR_URL=${USAGE_COLLECTOR_URL:-https://usage.picpeak.app}
      - USAGE_ENCRYPTION_KEY=${USAGE_ENCRYPTION_KEY:-}
      - OIDC_BREAK_GLASS=${OIDC_BREAK_GLASS:-}
      - INTEGRATION_PRIVATE_ORIGINS=${INTEGRATION_PRIVATE_ORIGINS:-}
      - ADMIN_URL=${ADMIN_URL:-}
      - TZ=${TZ:-UTC}
      - STORAGE_PATH=/app/storage
      - PUBLIC_UPLOAD_LIMITS_JSON=${PUBLIC_UPLOAD_LIMITS_JSON:-}
      - ADMIN_UPLOAD_LIMITS_JSON=${ADMIN_UPLOAD_LIMITS_JSON:-}
      # Native leases and portable restore; empty = the application's own
      # defaults (docs/PORTABLE_RESTORE.md).
      - MEDIA_PROCESS_HOST_ID=${MEDIA_PROCESS_HOST_ID:-}
      - MEDIA_PROCESS_LEASE_PATH=${MEDIA_PROCESS_LEASE_PATH:-}
      - PICPEAK_IMPORT_MAX_ENTRIES=${PICPEAK_IMPORT_MAX_ENTRIES:-}
      - PICPEAK_IMPORT_MAX_EXPANDED_BYTES=${PICPEAK_IMPORT_MAX_EXPANDED_BYTES:-}
      - PICPEAK_IMPORT_MAX_MANIFEST_BYTES=${PICPEAK_IMPORT_MAX_MANIFEST_BYTES:-}
      - PICPEAK_IMPORT_MAX_ROW_BYTES=${PICPEAK_IMPORT_MAX_ROW_BYTES:-}
      - PICPEAK_RESTORE_DRAIN_GRACE_MS=${PICPEAK_RESTORE_DRAIN_GRACE_MS:-}
      - PICPEAK_IMPORT_WORKER_MEMORY_MIB=${PICPEAK_IMPORT_WORKER_MEMORY_MIB:-}
      - PICPEAK_IMPORT_WORKER_TIMEOUT_MS=${PICPEAK_IMPORT_WORKER_TIMEOUT_MS:-}
      - PICPEAK_IMPORT_WORKER_CPU_SECONDS=${PICPEAK_IMPORT_WORKER_CPU_SECONDS:-}
      # Makes the entrypoint create /backup/picpeak and /backup/database and
      # chown the ./backup mount to UID 1001 (same as production).
      - BACKUP_DIR=/backup
      # Watch-folder auto-import: max photos processed in parallel (default 2).
      - FILE_WATCHER_CONCURRENCY=${FILE_WATCHER_CONCURRENCY:-2}
      # External-media folder watcher (issue 1187); all optional, see .env.example.
      - EXTERNAL_MEDIA_WATCH=${EXTERNAL_MEDIA_WATCH:-true}
      - EXTERNAL_MEDIA_WATCH_POLLING=${EXTERNAL_MEDIA_WATCH_POLLING:-false}
      - EXTERNAL_MEDIA_WATCH_POLL_INTERVAL_MS=${EXTERNAL_MEDIA_WATCH_POLL_INTERVAL_MS:-5000}
      - EXTERNAL_MEDIA_WATCH_SWEEP_INTERVAL_MS=${EXTERNAL_MEDIA_WATCH_SWEEP_INTERVAL_MS:-900000}
      - EXTERNAL_MEDIA_WATCH_DEBOUNCE_MS=${EXTERNAL_MEDIA_WATCH_DEBOUNCE_MS:-10000}
      - EXTERNAL_MEDIA_WATCH_STABILITY_MS=${EXTERNAL_MEDIA_WATCH_STABILITY_MS:-5000}
      # Face recognition (#1074). The URL defaults to the sidecar's compose
      # service name, so the common case needs no configuration. None of this
      # is touched until the `faces` feature flag is enabled in admin
      # settings — an install without the picpeak-ml container never attempts
      # a connection.
      - FACE_ML_URL=${FACE_ML_URL:-http://picpeak-ml:8000}
      - FACE_ML_TOKEN=${FACE_ML_TOKEN:-}
      - FACE_PROCESSOR_CONCURRENCY=${FACE_PROCESSOR_CONCURRENCY:-}
      # Scene tagging workers (issue 1733); empty keeps the default of 1.
      - TAG_PROCESSOR_CONCURRENCY=${TAG_PROCESSOR_CONCURRENCY:-}
      # Malware scanner for customer documents (#1444). Empty = no scanner;
      # uploads then wait for an admin's review. With the opt-in `clamav`
      # profile below, set CLAMAV_HOST=clamav. See docs/ENVIRONMENT_VARIABLES.md.
      - CLAMAV_HOST=${CLAMAV_HOST:-}
      - CLAMAV_PORT=${CLAMAV_PORT:-3310}
      - CLAMAV_TIMEOUT_MS=${CLAMAV_TIMEOUT_MS:-30000}
      - CLAMAV_MAX_BYTES=${CLAMAV_MAX_BYTES:-26214400}
    # No `user:` directive — as of #484, the container starts as root,
    # chowns the bind mounts to nodejs (UID 1001), then drops privileges
    # via su-exec. PUID/PGID env vars are no longer read; if you need
    # a different runtime UID, pre-chown the host dirs and pin
    # `user: "<uid>:<gid>"` here.
    volumes:
      - ./events:/app/events
      - ./data:/app/data
      - ./logs:/app/logs
      - ./backup:/backup
      - ./storage:/app/storage
      - picpeak-secrets:/run/secrets:ro
    ports:
      - "${PICPEAK_BACKEND_BIND_ADDRESS:-127.0.0.1}:${BACKEND_PORT:-3001}:3000"
    depends_on:
      secrets-init:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - picpeak-network

  postgres:
    image: postgres:15-alpine
    container_name: picpeak-postgres
    restart: unless-stopped
    userns_mode: "host"
    environment:
      - POSTGRES_USER=${DB_USER}
      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password
      - POSTGRES_DB=${DB_NAME}
      - PGDATA=/var/lib/postgresql/data/pgdata
      - TZ=${TZ:-UTC}
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - picpeak-db-secret:/run/secrets:ro
    depends_on:
      secrets-init:
        condition: service_completed_successfully
    ports:
      - "127.0.0.1:${DB_PORT:-5432}:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER} -d ${DB_NAME}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - picpeak-network

  redis:
    image: redis:7-alpine
    container_name: picpeak-redis
    restart: unless-stopped
    userns_mode: "host"
    command: sh -c 'exec redis-server --appendonly yes --requirepass "$$(cat /run/secrets/redis_password)"'
    volumes:
      - redis-data:/data
      - picpeak-redis-secret:/run/secrets:ro
    depends_on:
      secrets-init:
        condition: service_completed_successfully
    ports:
      - "127.0.0.1:${REDIS_PORT:-6379}:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - picpeak-network

  # Local mail catcher for development/testing only — never wanted in a real
  # deployment. Gated behind the `dev` profile so a plain `docker compose up -d`
  # does NOT start it; opt in with `docker compose --profile dev up -d`. Nothing
  # depends on it (SMTP_HOST comes from .env), so gating is safe.
  mailhog:
    image: mailhog/mailhog:latest
    container_name: picpeak-mailhog
    restart: unless-stopped
    profiles:
      - dev
    ports:
      - "${MAILHOG_SMTP_PORT:-1025}:1025"
      - "${MAILHOG_UI_PORT:-8025}:8025"
    networks:
      - picpeak-network

  # Optional face-detection sidecar (#1074). Gated behind the `faces` profile
  # so a plain `docker compose up -d` does NOT start it — opt in with
  # `docker compose --profile faces up -d`. Nothing depends on it: the backend
  # only ever calls it when the `faces` feature flag is on, so an install that
  # skips this service behaves exactly as it did before the feature existed.
  #
  # The service name is `picpeak-ml` (not `ml`) because it doubles as the
  # hostname in FACE_ML_URL's default, `http://picpeak-ml:8000`. Renaming this
  # service silently breaks that default for every install that never set the
  # variable.
  #
  # Requires FACENET_ONNX_URL / FACENET_ONNX_SHA256 at build time — see
  # ml/README.md. The image publishes no host port and mounts no volumes; it
  # is reachable only from the backend on picpeak-network.
  picpeak-ml:
    build:
      context: ./ml
      dockerfile: Dockerfile
      args:
        # Defaults live in ml/Dockerfile and point at the canonical published
        # model. These pass an override through from .env when set; an empty
        # value here would BLANK the Dockerfile default and fail the build,
        # so the fallbacks repeat it deliberately.
        - FACENET_ONNX_URL=${FACENET_ONNX_URL:-https://github.com/PicPeak/picpeak/releases/download/ml-models-v1/facenet512.onnx}
        - FACENET_ONNX_SHA256=${FACENET_ONNX_SHA256:-a1c06dcb79dc17a42af01d5bcbce4822caa148b9c24bf7eb8b8e556b4fd0d5db}
        # Scene-tagging encoder (issue 1733). Empty by default: the image is
        # then built without it and automatic tagging stays unavailable.
        - TAG_ENCODER_ONNX_URL=${TAG_ENCODER_ONNX_URL:-}
        - TAG_ENCODER_ONNX_SHA256=${TAG_ENCODER_ONNX_SHA256:-}
    container_name: picpeak-ml
    restart: unless-stopped
    profiles:
      - faces
    environment:
      # Shared secret with the backend. The container refuses to start
      # without it rather than serving anonymously.
      - FACE_ML_TOKEN=${FACE_ML_TOKEN:-}
      - FACE_ORT_THREADS=${FACE_ORT_THREADS:-1}
      # Scene tagging (issue 1733); only read once /tags is used.
      - TAG_SCORE_THRESHOLD=${TAG_SCORE_THRESHOLD:-0.01}
      - TAG_TOP_K=${TAG_TOP_K:-5}
      - TZ=${TZ:-UTC}
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=4).status == 200 else 1)"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - picpeak-network

  # Optional malware scanner for customer documents (#1444). Gated behind the
  # `clamav` profile — a plain `docker compose up -d` does NOT start it; opt
  # in with `docker compose --profile clamav up -d` and set CLAMAV_HOST=clamav
  # in .env. ClamAV holds its signature database in memory: plan for about
  # 1 GB of RAM, and a few minutes on first start while it downloads the
  # signatures (uploads stay pending meanwhile). No host port: only the
  # backend reaches it on picpeak-network.
  clamav:
    image: clamav/clamav:stable
    container_name: picpeak-clamav
    restart: unless-stopped
    profiles:
      - clamav
    volumes:
      - clamav-db:/var/lib/clamav
    networks:
      - picpeak-network

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        - VITE_API_URL=${VITE_API_URL:-/api}
    container_name: picpeak-frontend
    restart: unless-stopped
    environment:
      - NODE_ENV=${NODE_ENV:-production}
      # Static social-preview brand (#521) — substituted into
      # index.html at container start; see frontend/docker-entrypoint.sh.
      - BRAND_TITLE=${BRAND_TITLE:-PicPeak}
      - BRAND_DESCRIPTION=${BRAND_DESCRIPTION:-Photo gallery shared with PicPeak.}
    ports:
      - "${PICPEAK_BIND_ADDRESS:-0.0.0.0}:${FRONTEND_PORT:-3000}:80"
    depends_on:
      - backend
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - picpeak-network

volumes:
  postgres-data:
    driver: local
  redis-data:
    driver: local
  # Auto-generated machine secrets (jwt/db/redis). Keep it — deleting it orphans
  # the DB password from the Postgres volume.
  picpeak-secrets:
    driver: local
  # Copies of db_password and redis_password for the postgres and redis
  # containers alone. secrets-init rebuilds them from picpeak-secrets, so they
  # need no backup.
  picpeak-db-secret:
    driver: local
  picpeak-redis-secret:
    driver: local
  # ClamAV signature database (opt-in `clamav` profile). Re-downloadable;
  # needs no backup.
  clamav-db:
    driver: local

networks:
  picpeak-network:
    driver: bridge