# =============================================================================
#  maintainerd-auth — local quick-start stack (released image + nginx TLS edge)
#
#  nginx terminates HTTPS on the .local hostnames and forwards to the single
#  released image, so you browse clean URLs with no ports. Config comes from
#  ./.env and TLS certs from ./certs — run ./setup.sh first.
#  Guide: https://github.com/maintainerd/maintainerd-auth#quick-start
# =============================================================================
services:
  postgres:
    image: postgres:17-alpine
    environment:
      POSTGRES_USER: maintainerd
      POSTGRES_PASSWORD: change-me
      POSTGRES_DB: maintainerd
    volumes: [pgdata:/var/lib/postgresql/data]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U maintainerd"]
      interval: 5s
      retries: 10

  redis:
    image: redis:7-alpine

  auth:
    image: xreyc/maintainerd-auth:latest   # or pin the exact version, :0.1.0
    depends_on:
      postgres: { condition: service_healthy }
      redis: { condition: service_started }
    volumes:
      - ./.env:/.env:ro   # the app reads this at startup
    # No ports published — nginx is the only entry point.

  nginx:
    image: nginx:latest
    depends_on: [auth]
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - ./certs:/etc/nginx/certs:ro
    networks:
      default:
        aliases:
          - console.auth.maintainerd.local
          - identity.auth.maintainerd.local
          - console-api.auth.maintainerd.local
          - identity-api.auth.maintainerd.local

volumes:
  pgdata: