services:
  postgres:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-containr}
      POSTGRES_USER: ${POSTGRES_USER:-containr_user}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-dev_password_123}
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-containr_user} -d ${POSTGRES_DB:-containr}"]
      interval: 10s
      timeout: 5s
      retries: 10
    restart: unless-stopped

  dragonfly:
    image: docker.dragonflydb.io/dragonflydb/dragonfly:${DRAGONFLY_VERSION:-latest}
    command:
      - --requirepass=${REDIS_PASSWORD:-dev_redis_123}
      - --proactor_threads=${DRAGONFLY_THREADS:-1}
      - --maxmemory=${DRAGONFLY_MAXMEMORY:-256mb}
      - --dir=/data
    ports:
      - "${REDIS_PORT:-6379}:6379"
    volumes:
      - dragonfly_data:/data
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a ${REDIS_PASSWORD:-dev_redis_123} ping | grep PONG"]
      interval: 10s
      timeout: 5s
      retries: 10
    restart: unless-stopped

  backend:
    image: ghcr.io/dvorinka/containr-backend:${CONTAINR_VERSION:-latest}
    pull_policy: missing
    build:
      context: ./app/backend
      dockerfile: Dockerfile
    ports:
      - "${API_PORT:-8082}:8080"
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER:-containr_user}:${POSTGRES_PASSWORD:-dev_password_123}@postgres:5432/${POSTGRES_DB:-containr}?sslmode=disable
      REDIS_URL: redis://:${REDIS_PASSWORD:-dev_redis_123}@dragonfly:6379/0
      PORT: 8080
      HOST: 0.0.0.0
      ENVIRONMENT: ${ENVIRONMENT:-development}
      JWT_SECRET: ${JWT_SECRET:-dev_jwt_secret_key_change_in_production}
      COOKIE_SECURE: ${COOKIE_SECURE:-false}
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000,http://localhost:8082}
      BETTER_AUTH_URL: ${BETTER_AUTH_URL:-http://localhost:8082}
      BETTER_AUTH_PROXY_URL: ${BETTER_AUTH_PROXY_URL:-http://127.0.0.1:3001}
      BETTER_AUTH_INTERNAL_URL: ${BETTER_AUTH_INTERNAL_URL:-http://127.0.0.1:3001/internal/session}
      BETTER_AUTH_INTERNAL_TOKEN: ${BETTER_AUTH_INTERNAL_TOKEN:-PLACEHOLDER_INTERNAL_AUTH_TOKEN}
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:-PLACEHOLDER_BETTER_AUTH_SECRET_CHANGE_ME_32CHARS_MIN}
      BETTER_AUTH_AUTO_MIGRATE: ${BETTER_AUTH_AUTO_MIGRATE:-true}
      BETTER_AUTH_TRUSTED_ORIGINS: ${BETTER_AUTH_TRUSTED_ORIGINS:-http://localhost:3000,http://localhost:8082}
      FRONTEND_URL: ${FRONTEND_URL:-http://localhost:3000}
      BACKEND_URL: ${BACKEND_URL:-http://localhost:8082}
      AUTH_PORT: ${AUTH_PORT:-3001}
      DB_HOST: postgres
      DB_PORT: 5432
      DB_NAME: ${POSTGRES_DB:-containr}
      DB_USER: ${POSTGRES_USER:-containr_user}
      DB_PASSWORD: ${POSTGRES_PASSWORD:-dev_password_123}
      CONTAINR_AGENT_AUTH_TOKEN: ${CONTAINR_AGENT_AUTH_TOKEN:-}
      ADMIN_EMAIL: ${ADMIN_EMAIL:-}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:-}
      ADMIN_NAME: ${ADMIN_NAME:-}
      CONTAINR_AGENT_AUTH_TOKENS: ${CONTAINR_AGENT_AUTH_TOKENS:-}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      CONTAINR_UPGRADE_IMAGE_REF: ${CONTAINR_UPGRADE_IMAGE_REF:-}
      GITHUB_CONTAINER_REGISTRY_USER: ${GITHUB_CONTAINER_REGISTRY_USER:-}
      GITHUB_CONTAINER_REGISTRY_TOKEN: ${GITHUB_CONTAINER_REGISTRY_TOKEN:-}
      GITHUB_APP_ID: ${GITHUB_APP_ID:-}
      GITHUB_APP_SLUG: ${GITHUB_APP_SLUG:-}
      GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY:-}
      GITHUB_APP_BASE_URL: ${GITHUB_APP_BASE_URL:-https://api.github.com}
      GITLAB_API_URL: ${GITLAB_API_URL:-https://gitlab.com/api/v4}
      GITLAB_BASE_URL: ${GITLAB_BASE_URL:-https://gitlab.com}
      BITBUCKET_API_URL: ${BITBUCKET_API_URL:-https://api.bitbucket.org/2.0}
      BITBUCKET_BASE_URL: ${BITBUCKET_BASE_URL:-https://bitbucket.org}
      GITEA_BASE_URL: ${GITEA_BASE_URL:-https://gitea.example.com}
    volumes:
      # Required for service deployments and managed sidecars (e.g. cloudflared)
      - /var/run/docker.sock:/var/run/docker.sock
    # Grants the non-root backend user access to the Docker socket.
    # install.sh writes the host's docker gid into DOCKER_GID.
    group_add:
      - "${DOCKER_GID:-0}"
    depends_on:
      postgres:
        condition: service_healthy
      dragonfly:
        condition: service_healthy
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:8080/health"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s

  frontend:
    image: ghcr.io/dvorinka/containr-frontend:${CONTAINR_VERSION:-latest}
    pull_policy: missing
    build:
      context: ./app/frontend
      dockerfile: Dockerfile
      args:
        VITE_API_URL: ${VITE_API_URL:-}
        VITE_AUTH_URL: ${VITE_AUTH_URL:-}
    ports:
      - "${HTTP_PORT:-3000}:80"
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped

volumes:
  postgres_data:
  dragonfly_data: