# Lokales Dev-Compose. Härtung ggü. Backlog-Findings:
#   - F-11: alle Images auf konkrete Tags gepinnt (kein :latest / rollender Tag)
#   - F-18: Host-Ports NUR auf 127.0.0.1 gebunden (nicht auf allen Interfaces des
#           Entwicklerrechners); Redis mit Passwort (requirepass);
#           security_opt no-new-privileges auf allen Services.
# Für Prod/Testserver gilt docker-compose.coolify.yml (Netzsegmentierung, Limits etc.).
services:
  app:
    build: .
    ports:
      - "127.0.0.1:3000:3000"
    env_file: .env
    security_opt:
      - "no-new-privileges:true"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
      garage:
        condition: service_healthy
      garage-provision:
        condition: service_completed_successfully
    restart: unless-stopped

  # Wird in Iteration 4 aktiviert (BullMQ-Scheduler, siehe docs/SPEC.md §4.5)
  worker:
    profiles: ["worker"]
    build: .
    command: ["npm", "run", "worker"]
    env_file: .env
    security_opt:
      - "no-new-privileges:true"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    restart: unless-stopped

  postgres:
    image: pgvector/pgvector:0.8.0-pg16
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-isms}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-isms}
      POSTGRES_DB: ${POSTGRES_DB:-isms}
    volumes:
      - pgdata:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5432:5432"
    security_opt:
      - "no-new-privileges:true"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-isms}"]
      interval: 5s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7.4.2-alpine
    # F-18: Redis mit Passwort. REDIS_URL in .env muss das Passwort tragen, z. B.
    # redis://:${REDIS_PASSWORD}@localhost:6379
    command: ["redis-server", "--requirepass", "${REDIS_PASSWORD:-isms-redis}"]
    volumes:
      - redisdata:/data
    ports:
      - "127.0.0.1:6379:6379"
    security_opt:
      - "no-new-privileges:true"

  # Objektspeicher: Garage (S3-kompatibel) — ersetzt MinIO (EOL). S3-API auf 3900,
  # Admin-API auf 3903 (nur lokal gebunden). Dev-Secrets kommen aus .env (siehe
  # .env.example: GARAGE_RPC_SECRET/GARAGE_ADMIN_TOKEN, S3_ACCESS_KEY/S3_SECRET_KEY).
  garage:
    image: dxflrs/garage:v1.2.0
    environment:
      GARAGE_RPC_SECRET: ${GARAGE_RPC_SECRET:-0000000000000000000000000000000000000000000000000000000000000002}
      GARAGE_ADMIN_TOKEN: ${GARAGE_ADMIN_TOKEN:-0000000000000000000000000000000000000000000000000000000000000003}
    volumes:
      - ./deploy/garage.toml:/etc/garage.toml:ro
      - garage_meta:/var/lib/garage/meta
      - garage_data:/var/lib/garage/data
    ports:
      - "127.0.0.1:3900:3900"
      - "127.0.0.1:3903:3903"
    security_opt:
      - "no-new-privileges:true"
    healthcheck:
      test: ["CMD", "/garage", "status"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 5s

  # Idempotenter Provisioning-Job (Layout + Bucket + Key + Rechte via Admin-API).
  # Nutzt das App-Image (tsx vorhanden); läuft einmalig vor der app.
  garage-provision:
    build: .
    command: ["npx", "tsx", "scripts/garage-provision.ts"]
    environment:
      GARAGE_ADMIN_URL: http://garage:3903
      GARAGE_ADMIN_TOKEN: ${GARAGE_ADMIN_TOKEN:-0000000000000000000000000000000000000000000000000000000000000003}
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-GKdead0000beef0000cafe0000}
      S3_SECRET_KEY: ${S3_SECRET_KEY:-0000000000000000000000000000000000000000000000000000000000000001}
      S3_BUCKET: ${S3_BUCKET:-isms-documents}
      GARAGE_CAPACITY_BYTES: ${GARAGE_CAPACITY_BYTES:-10000000000}
    security_opt:
      - "no-new-privileges:true"
    depends_on:
      garage:
        condition: service_healthy
    restart: "no"

  mailhog:
    image: mailhog/mailhog:v1.0.1
    profiles: ["dev"]
    ports:
      - "127.0.0.1:1025:1025"
      - "127.0.0.1:8025:8025"
    security_opt:
      - "no-new-privileges:true"

volumes:
  pgdata:
  redisdata:
  garage_meta:
  garage_data: