services:
  postgres:
    image: postgres:18
    container_name: procurement-postgres

    environment:
      POSTGRES_DB: procurement
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres

    ports:
      - "5433:5432"

    volumes:
      - postgres_data:/var/lib/postgresql
      - ./sql/migration.sql:/docker-entrypoint-initdb.d/01-migration.sql:ro
      # - ./sql/seed.sql:/docker-entrypoint-initdb.d/02-seed.sql:ro

    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d procurement"]
      interval: 5s
      timeout: 5s
      retries: 10

    restart: unless-stopped

  minio:
    image: minio/minio:latest
    container_name: procurement-minio

    command: server /data --console-address ":9001"

    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin

    ports:
      - "9000:9000"   # S3 API
      - "9001:9001"   # Web console

    volumes:
      - minio_data:/data

    restart: unless-stopped

  # MinIO Client (mc): waits for the server, creates the bucket, exits.
  # Use for ad-hoc ops too: docker compose run --rm minio-init ...
  minio-init:
    image: minio/mc:latest
    container_name: procurement-minio-init

    depends_on:
      minio:
        condition: service_started

    environment:
      MINIO_ENDPOINT: minio:9000
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
      MINIO_BUCKET: procurement-files

    entrypoint: >
      /bin/sh -c "
      until mc alias set local http://$${MINIO_ENDPOINT} $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD}; do
        echo 'waiting for minio server...'; sleep 2;
      done;
      mc mb --ignore-existing local/$${MINIO_BUCKET};
      echo bucket $${MINIO_BUCKET} ready;
      "

    restart: "no"

  # ==========================================================================
  # v2.6 — Casdoor (OIDC identity provider)
  # Console: http://localhost:8080 (admin / 123)
  # Application "inventory-app" (org "inventory", client inventory-app-client)
  # is created by backend/tools/seed_casdoor.py — run it once after the
  # first boot:
  #   docker compose run --rm -e CASDOOR_BASE=http://casdoor:8000 api python tools/seed_casdoor.py
  # ==========================================================================
  casdoor-postgres:
    image: postgres:16
    container_name: procurement-casdoor-postgres
    environment:
      POSTGRES_DB: casdoor
      POSTGRES_USER: casdoor
      POSTGRES_PASSWORD: casdoor
    volumes:
      - casdoor_postgres_data:/var/lib/postgresql
    restart: unless-stopped

  casdoor:
    image: casbin/casdoor:latest
    container_name: procurement-casdoor
    depends_on:
      - casdoor-postgres
    environment:
      RUNNING_IN_DOCKER: "true"
      driverName: postgres
      dataSourceName: "user=casdoor password=casdoor host=casdoor-postgres port=5432 sslmode=disable dbname=casdoor"
      dbName: casdoor
      origin: "http://localhost:8080"
    ports:
      - "8080:8000"
    restart: unless-stopped

  api:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: procurement-api

    environment:
      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:postgres@postgres:5432/procurement
      PROCUREMENT_MINIO_ENDPOINT: minio:9000
      PROCUREMENT_MINIO_ACCESS_KEY: minioadmin
      PROCUREMENT_MINIO_SECRET_KEY: minioadmin
      PROCUREMENT_MINIO_BUCKET: procurement-files
      PROCUREMENT_MINIO_SECURE: "false"
      # Casdoor: endpoint is the in-network service URL; the issuer must match
      # the origin Casdoor advertises to browsers (its OIDC discovery doc).
      PROCUREMENT_CASDOOR_ENDPOINT: http://casdoor:8000
      PROCUREMENT_CASDOOR_ISSUER: http://localhost:8080
      PROCUREMENT_CASDOOR_CLIENT_ID: inventory-app-client
      PROCUREMENT_CASDOOR_CLIENT_SECRET: inventory-app-secret-2026
      PROCUREMENT_CASDOOR_ORGANIZATION: inventory
      PROCUREMENT_CASDOOR_APP_NAME: inventory-app
      PROCUREMENT_CASDOOR_AUDIENCE: inventory-app-client

    ports:
      - "8000:8000"

    depends_on:
      postgres:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully

    restart: unless-stopped

  frontend:
    build:
      context: ./frontend
      args:
        # Developer Mode panel on the login page — set false for production.
        DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-true}
    container_name: procurement-frontend

    ports:
      - "3000:80"

    depends_on:
      - api

    restart: unless-stopped

volumes:
  postgres_data:
  minio_data:
  casdoor_postgres_data: