services:
  db:
    image: postgres:16-alpine
    container_name: reqmango-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${DB_USER:-reqmango}
      POSTGRES_PASSWORD: ${DB_PASSWORD:-reqmango}
      POSTGRES_DB: ${DB_NAME:-reqmango}
    ports:
      - "${DB_PORT:-5432}:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-reqmango}"]
      interval: 5s
      timeout: 5s
      retries: 5

  backend:
    # Published multi-arch image. `docker compose up --build` still builds
    # locally; `docker compose pull` uses this instead.
    image: ${REQMANGO_BACKEND_IMAGE:-ghcr.io/vinthuy/reqmango-backend:${REQMANGO_TAG:-latest}}
    build:
      context: ./backend
      args:
        VERSION: ${REQMANGO_TAG:-dev}
        COMMIT: ${REQMANGO_COMMIT:-unknown}
        BUILD_DATE: ${REQMANGO_BUILD_DATE:-unknown}
    container_name: reqmango-backend
    restart: unless-stopped
    ports:
      - "${API_PORT:-8000}:8000"
    environment:
      DATABASE_URL: "postgres://${DB_USER:-reqmango}:${DB_PASSWORD:-reqmango}@db:5432/${DB_NAME:-reqmango}?sslmode=disable"
      # SECRET_KEY signs JWTs. Do not use a public default here: leave it unset and
      # the backend generates a random key, or set it in .env (openssl rand -hex 32).
      SECRET_KEY: ${SECRET_KEY:-}
      ACCESS_TOKEN_EXPIRE_MINUTES: "${ACCESS_TOKEN_EXPIRE_MINUTES:-10080}"
      PORT: "8000"
      DEBUG: "${DEBUG:-false}"
      # Logging and rate limiting: these are read from the process environment,
      # so Compose has to forward them explicitly or setting them in .env does
      # nothing (it silently used the code defaults before).
      DB_LOG_LEVEL: "${DB_LOG_LEVEL:-}"
      SLOW_REQUEST_MS: "${SLOW_REQUEST_MS:-1000}"
      RATE_LIMIT_REQUESTS: "${RATE_LIMIT_REQUESTS:-500}"
      RATE_LIMIT_WINDOW_SEC: "${RATE_LIMIT_WINDOW_SEC:-60}"
      AI_API_KEY: ${AI_API_KEY:-}
      DEEPSEEK_API_KEY: ${DEEPSEEK_API_KEY:-}
      AI_MODEL: ${AI_MODEL:-deepseek-chat}
      AI_BASE_URL: ${AI_BASE_URL:-https://api.deepseek.com/v1}
      AI_PROVIDER: ${AI_PROVIDER:-deepseek}
      # Demo accounts have published passwords. .env.example turns this on for
      # the local demo; keep it false for any real deployment.
      SEED_DEMO: "${SEED_DEMO:-false}"
      SEED_E2E: "${SEED_E2E:-false}"
      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
    depends_on:
      db:
        condition: service_healthy

  frontend:
    image: ${REQMANGO_FRONTEND_IMAGE:-ghcr.io/vinthuy/reqmango-frontend:${REQMANGO_TAG:-latest}}
    build:
      context: ./frontend
      args:
        VERSION: ${REQMANGO_TAG:-dev}
        COMMIT: ${REQMANGO_COMMIT:-unknown}
    container_name: reqmango-frontend
    restart: unless-stopped
    ports:
      - "${WEB_PORT:-80}:80"
    depends_on:
      - backend

volumes:
  pgdata: