services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    container_name: '${APP_NAME}-app'
    ports:
      - "${APP_PUBLISHED_PORT:-10080}:80"
    environment:
      SERVER_NAME: ${SERVER_NAME:-:80}
      APP_ENV: prod
      APP_VERSION: ${APP_VERSION:-1.0.0}
      APP_SECRET: ${APP_SECRET}
      APP_PUBLIC_HOSTNAME: ${APP_PUBLIC_HOSTNAME:-localhost}
      APP_CONTACT_MAIL_ADDRESS: ${APP_CONTACT_MAIL_ADDRESS:-7system7@gmail.com}
      DATABASE_URL: >-
        postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?serverVersion=${POSTGRES_VERSION}&charset=utf8
      POSTGRES_URL: db
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      MERCURE_URL: http://localhost/.well-known/mercure
      MERCURE_PUBLIC_URL: https://${APP_PUBLIC_HOSTNAME:-localhost}/.well-known/mercure
      MERCURE_JWT_SECRET: ${MERCURE_JWT_SECRET}
      MERCURE_JWT_TOKEN: ${MERCURE_JWT_TOKEN}
      MERCURE_SUBSCRIBER_JWT: ${MERCURE_SUBSCRIBER_JWT}
      MAILER_DSN: smtp://mail:25?verify_peer=0
      CAP_API_ENDPOINT: ${CAP_API_ENDPOINT}
      CAP_SECRET_KEY: ${CAP_SECRET_KEY}
      WEBAUTHN_RP_ID: ${WEBAUTHN_RP_ID:-localhost}
      WEBAUTHN_ORIGIN: ${WEBAUTHN_ORIGIN:-https://localhost}
      STORAGE_ACCESS_KEY: ${STORAGE_ACCESS_KEY}
      STORAGE_SECRET_KEY: ${STORAGE_SECRET_KEY}
      STORAGE_ENDPOINT: http://rustfs:9000
      STORAGE_PUBLIC_URL: ${STORAGE_PUBLIC_URL:-http://localhost:9010}
      # IMPORTANT: Set TRUSTED_PROXIES to your reverse proxy IP in production.
      # For Docker on same host, use: 172.17.0.1 (default bridge) or 172.16.0.0/12 (overlay network)
      # For Kubernetes or external proxy, use the proxy's IP address.
      # WARNING: Using 0.0.0.0/0 is insecure in production environments!
      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1}
    volumes:
      - app_var:/app/var
      - caddy_data:/data
      - caddy_config:/config
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1/ -o /dev/null"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 60s
    depends_on:
      db:
        condition: service_healthy
      mail:
        condition: service_started
      rustfs:
        condition: service_healthy
      rustfs_init:
        condition: service_completed_successfully
  scheduler:
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    container_name: '${APP_NAME}-scheduler'
    command: ['php', 'bin/console', 'messenger:consume', 'scheduler_default', '--env=prod', '--no-interaction', '--memory-limit=128M']
    environment:
      APP_ENV: prod
      APP_SECRET: ${APP_SECRET}
      APP_PUBLIC_HOSTNAME: ${APP_PUBLIC_HOSTNAME:-localhost}
      DATABASE_URL: >-
        postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?serverVersion=${POSTGRES_VERSION}&charset=utf8
      POSTGRES_URL: db
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
      MERCURE_URL: http://localhost/.well-known/mercure
      MERCURE_PUBLIC_URL: https://${APP_PUBLIC_HOSTNAME:-localhost}/.well-known/mercure
      MERCURE_JWT_SECRET: ${MERCURE_JWT_SECRET}
      MERCURE_JWT_TOKEN: ${MERCURE_JWT_TOKEN}
      MERCURE_SUBSCRIBER_JWT: ${MERCURE_SUBSCRIBER_JWT}
      MAILER_DSN: smtp://mail:25?verify_peer=0
      CAP_API_ENDPOINT: ${CAP_API_ENDPOINT}
      CAP_SECRET_KEY: ${CAP_SECRET_KEY}
      WEBAUTHN_RP_ID: ${WEBAUTHN_RP_ID:-localhost}
      WEBAUTHN_ORIGIN: ${WEBAUTHN_ORIGIN:-https://localhost}
      STORAGE_ACCESS_KEY: ${STORAGE_ACCESS_KEY}
      STORAGE_SECRET_KEY: ${STORAGE_SECRET_KEY}
      STORAGE_ENDPOINT: http://rustfs:9000
      STORAGE_PUBLIC_URL: ${STORAGE_PUBLIC_URL:-http://localhost:9010}
      TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1}
    volumes:
      - app_var:/app/var
    depends_on:
      db:
        condition: service_healthy
      mail:
        condition: service_started
      rustfs:
        condition: service_healthy
      rustfs_init:
        condition: service_completed_successfully
    healthcheck:
      disable: true

  rustfs:
    image: rustfs/rustfs:1.0.3
    restart: unless-stopped
    container_name: '${APP_NAME}-rustfs'
    environment:
      RUSTFS_ACCESS_KEY: ${STORAGE_ACCESS_KEY}
      RUSTFS_SECRET_KEY: ${STORAGE_SECRET_KEY}
      RUSTFS_ADDRESS: ':9000'
      RUSTFS_CONSOLE_ADDRESS: ':9001'
      RUSTFS_CONSOLE_ENABLE: 'true'
    volumes:
      - rustfs_data:/data
    ports:
      - "${RUSTFS_PUBLISHED_API_PORT:-9010}:9000"
      - "${RUSTFS_PUBLISHED_CONSOLE_PORT:-9011}:9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/health"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 15s
  rustfs_init:
    build:
      context: ./docker/storage-init
    entrypoint: ["python"]
    command: ["/usr/local/bin/storage-init.py"]
    restart: "no"
    container_name: '${APP_NAME}-rustfs-init'
    depends_on:
      rustfs:
        condition: service_healthy
    environment:
      TARGET_ENDPOINT: http://rustfs:9000
      STORAGE_ACCESS_KEY: ${STORAGE_ACCESS_KEY}
      STORAGE_SECRET_KEY: ${STORAGE_SECRET_KEY}
      STORAGE_BUCKET: mineseeker
  mail:
    image: boky/postfix:latest
    restart: unless-stopped
    container_name: '${APP_NAME}-mail'
    hostname: postfix.mail.${MAIL_DOMAIN:-localhost}
    environment:
      ALLOWED_SENDER_DOMAINS: ${MAIL_DOMAIN:-localhost}
      HOSTNAME: postfix.mail.${MAIL_DOMAIN:-localhost}
      POSTFIX_myhostname: postfix.mail.${MAIL_DOMAIN:-localhost}
      POSTFIX_mynetworks: "127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
      POSTFIX_smtpd_tls_security_level: none
      RELAYHOST: ${MAIL_RELAYHOST:-}
      RELAYHOST_AUTH: ${MAIL_RELAYHOST_AUTH:-}
      RELAYHOST_PASSWORD: ${MAIL_RELAYHOST_PASSWORD:-}
    volumes:
      - postfix_spool:/var/spool/postfix
      - ./docker/aliases:/tmp/aliases:ro
  db:
    image: postgres:${POSTGRES_VERSION:-18}-alpine
    restart: unless-stopped
    container_name: '${APP_NAME}-db'
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}" ]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 10s
    ports:
      - "${POSTGRES_PUBLISHED_PORT:-5452}:5432"
volumes:
  app_var:
  postgres_data:
  caddy_data:
  caddy_config:
  postfix_spool:
  rustfs_data: