# docker-compose.prod.yml - Production configuration
version: '3.8'

services:
  backend:
    image: picpeak-backend:latest
    build:
      context: ./backend
      dockerfile: Dockerfile
    restart: unless-stopped
    depends_on:
      - db
    environment:
      - NODE_ENV=production
      - PORT=3000
      - JWT_SECRET=${JWT_SECRET}
      - ADMIN_URL=${ADMIN_URL}
      - FRONTEND_URL=${FRONTEND_URL}
      # Database
      - DATABASE_CLIENT=pg
      - DB_HOST=db
      - DB_PORT=5432
      - DB_USER=${DB_USER:-picpeak}
      - DB_PASSWORD=${DB_PASSWORD}
      - DB_NAME=${DB_NAME:-picpeak}
      # Email
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT}
      - SMTP_SECURE=${SMTP_SECURE}
      - SMTP_USER=${SMTP_USER}
      - SMTP_PASS=${SMTP_PASS}
      - EMAIL_FROM=${EMAIL_FROM}
      # Analytics
      - UMAMI_URL=${UMAMI_URL}
      - UMAMI_WEBSITE_ID=${UMAMI_WEBSITE_ID}
      # Storage paths
      - STORAGE_PATH=/app/storage
      - EVENTS_PATH=/app/storage/events
      - ARCHIVE_PATH=/app/storage/events/archived
    volumes:
      - ./storage:/app/storage
      - ./data:/app/data
      - ./logs:/app/logs
    networks:
      - picpeak

  frontend:
    image: picpeak-frontend:latest
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        - VITE_API_URL=/api
    restart: unless-stopped
    depends_on:
      - backend
    networks:
      - picpeak

  nginx:
    image: nginx:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf
      - ./nginx/sites-enabled:/etc/nginx/sites-enabled
      - ./certbot/conf:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
    depends_on:
      - frontend
      - backend
    networks:
      - picpeak
    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"

  certbot:
    image: certbot/certbot
    restart: unless-stopped
    volumes:
      - ./certbot/conf:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"

  db:
    image: postgres:14-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${DB_USER:-picpeak}
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - POSTGRES_DB=${DB_NAME:-picpeak}
      # Allow connections from any host with password authentication
      - POSTGRES_HOST_AUTH_METHOD=scram-sha-256
      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 --auth-local=trust
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - picpeak
    # Allow connections without SSL requirement from Docker network
    command: postgres -c ssl=off

  umami:
    image: ghcr.io/umami-software/umami:postgresql-latest
    restart: unless-stopped
    environment:
      DATABASE_URL: postgresql://${DB_USER:-picpeak}:${DB_PASSWORD}@db:5432/umami
      DATABASE_TYPE: postgresql
      HASH_SALT: ${UMAMI_HASH_SALT}
    depends_on:
      - db
    networks:
      - picpeak

networks:
  picpeak:
    driver: bridge

volumes:
  postgres_data: