version: '3.8'

services:
  postgres:
    image: postgres:16-alpine
    container_name: wallet-hub-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${DB_USER:-wallet_hub}
      POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD must be set (no insecure default)}
      POSTGRES_DB: ${DB_NAME:-wallet_hub}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-wallet_hub}"]
      interval: 10s
      timeout: 5s
      retries: 5

  api:
    build:
      context: ..
      dockerfile: deploy/Dockerfile.api
    container_name: wallet-hub-api
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: 3005
      DATABASE_URL: postgresql://${DB_USER:-wallet_hub}:${DB_PASSWORD:?DB_PASSWORD must be set (no insecure default)}@postgres:5432/${DB_NAME:-wallet_hub}
      PLATFORM_ADMIN_API_KEY: ${API_KEY}
      TURNKEY_API_PUBLIC_KEY: ${TURNKEY_API_PUBLIC_KEY}
      TURNKEY_API_PRIVATE_KEY: ${TURNKEY_API_PRIVATE_KEY}
      TURNKEY_ORGANIZATION_ID: ${TURNKEY_ORGANIZATION_ID}
      TURNKEY_OTP_EMAIL_APP_NAME: ${TURNKEY_OTP_EMAIL_APP_NAME:-Arch Wallet}
      TURNKEY_OTP_EMAIL_LOGO_URL: ${TURNKEY_OTP_EMAIL_LOGO_URL:-}
      TURNKEY_OTP_EMAIL_MAGIC_LINK_TEMPLATE: ${TURNKEY_OTP_EMAIL_MAGIC_LINK_TEMPLATE:-}
      TURNKEY_OTP_EMAIL_TEMPLATE_ID: ${TURNKEY_OTP_EMAIL_TEMPLATE_ID:-}
      TURNKEY_OTP_EMAIL_SENDER_NAME: ${TURNKEY_OTP_EMAIL_SENDER_NAME:-}
      TURNKEY_OTP_EMAIL_SENDER_ADDRESS: ${TURNKEY_OTP_EMAIL_SENDER_ADDRESS:-}
      TURNKEY_OTP_EMAIL_REPLY_TO_ADDRESS: ${TURNKEY_OTP_EMAIL_REPLY_TO_ADDRESS:-}
      TURNKEY_OTP_EMAIL_CUSTOMIZATION_JSON: ${TURNKEY_OTP_EMAIL_CUSTOMIZATION_JSON:-}
      ARCH_RPC_NODE_URL: ${ARCH_RPC_URL:-https://rpc.testnet.arch.network}
      ARCH_RPC_NODE_URL_TESTNET: ${ARCH_RPC_NODE_URL_TESTNET:-https://rpc.testnet.arch.network}
      ARCH_RPC_NODE_URL_MAINNET: ${ARCH_RPC_NODE_URL_MAINNET:-https://rpc.mainnet.arch.network}
      INDEXER_BASE_URL: ${INDEXER_BASE_URL:-https://explorer.arch.network/api/v1/testnet}
      INDEXER_API_KEY: ${INDEXER_API_KEY:-}
      INDEXER_TIMEOUT_MS: ${INDEXER_TIMEOUT_MS:-30000}
      ARCH_TRANSFER_REQUIRE_ANCHORED_UTXO: ${ARCH_TRANSFER_REQUIRE_ANCHORED_UTXO:-false}
      # Rate limiting currently OFF (defaults to false here to remove
      # throttling). App code defaults to true; set RATE_LIMIT_ENABLED=true
      # in your .env to re-enable global + per-route limits.
      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED:-false}
      # No wildcard default: a production deployment must declare the
      # exact origins it serves (comma-separated).
      CORS_ALLOW_ORIGINS: ${CORS_ALLOW_ORIGINS:?set explicit allowed origins (no wildcard default)}
    ports:
      - "3005:3005"

  frontend:
    build:
      context: ..
      dockerfile: deploy/Dockerfile.frontend
      args:
        VITE_WALLET_HUB_BASE_URL: ${VITE_WALLET_HUB_BASE_URL:-http://localhost:3005/v1}
    container_name: wallet-hub-frontend
    restart: unless-stopped
    depends_on:
      - api
    environment:
      INTERNAL_API_KEY: ${INTERNAL_API_KEY}
    ports:
      - "80:80"
      - "443:443"

volumes:
  postgres_data: