services:
  postgres:
    image: postgres:18

    environment:
      POSTGRES_DB: procurement
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres

    ports:
      - "5435:5432"

    volumes:
      - postgres_data:/var/lib/postgresql
      - ./sql/migration.sql:/docker-entrypoint-initdb.d/01-migration.sql:ro
      - ./sql/02-casdoor-db.sql:/docker-entrypoint-initdb.d/02-casdoor-db.sql:ro

    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d procurement"]
      interval: 5s
      timeout: 5s
      retries: 10

    restart: unless-stopped

  traefik:
    image: traefik:v3.6
    restart: unless-stopped
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=erp_production_network
      - --providers.file.filename=/etc/traefik/dynamic.yml
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL:-admin@example.com}
      - --certificatesresolvers.letsencrypt.acme.storage=/certs/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      - --log.level=INFO
    ports:
      - "8084:80"
      - "8445:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./infra/traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
      - traefik_certs:/certs
    networks:
      - traefik_network

  minio:
    image: minio/minio:latest

    command: server /data --console-address ":9001"

    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin

    ports:
      - "9004:9000"   # S3 API
      - "9005:9001"   # Web console

    volumes:
      - minio_data:/data

    labels:
      - traefik.enable=true
      - traefik.http.routers.minio-api.rule=Host(`${S3_HOST:-s3.localhost}`)
      - traefik.http.routers.minio-api.entrypoints=web
      - traefik.http.routers.minio-api.service=minio-api-svc
      - traefik.http.services.minio-api-svc.loadbalancer.server.port=9000
      - traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:-storage.localhost}`)
      - traefik.http.routers.minio-console.entrypoints=web
      - traefik.http.routers.minio-console.service=minio-console-svc
      - traefik.http.services.minio-console-svc.loadbalancer.server.port=9001

    networks:
      - traefik_network
      - default

    restart: unless-stopped

  minio-init:
    image: minio/mc:latest

    depends_on:
      minio:
        condition: service_started

    environment:
      MINIO_ENDPOINT: minio:9000
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
      MINIO_BUCKET: procurement-files

    entrypoint: >
      /bin/sh -c "
      until mc alias set local http://$${MINIO_ENDPOINT} $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD}; do
        echo 'waiting for minio server...'; sleep 2;
      done;
      mc mb --ignore-existing local/$${MINIO_BUCKET};
      echo bucket $${MINIO_BUCKET} ready;
      "

    restart: "no"

  casdoor:
    image: casbin/casdoor:latest
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      RUNNING_IN_DOCKER: "true"
      driverName: postgres
      dataSourceName: "user=casdoor password=casdoor host=postgres port=5432 sslmode=disable dbname=casdoor"
      dbName: casdoor
      origin: "http://localhost:8083"
    ports:
      - "8083:8000"

    labels:
      - traefik.enable=true
      - traefik.http.routers.casdoor.rule=Host(`${AUTH_HOST:-auth.localhost}`)
      - traefik.http.routers.casdoor.entrypoints=web
      - traefik.http.services.casdoor.loadbalancer.server.port=8000

    networks:
      - traefik_network
      - default

    restart: unless-stopped

  api:
    build:
      context: ./backend
      dockerfile: Dockerfile

    environment:
      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:postgres@postgres:5432/procurement
      PROCUREMENT_MINIO_ENDPOINT: minio:9000
      PROCUREMENT_MINIO_ACCESS_KEY: minioadmin
      PROCUREMENT_MINIO_SECRET_KEY: minioadmin
      PROCUREMENT_MINIO_BUCKET: procurement-files
      PROCUREMENT_MINIO_SECURE: "false"
      PROCUREMENT_CASDOOR_ENDPOINT: http://casdoor:8000
      PROCUREMENT_CASDOOR_ISSUER: http://localhost:8083
      PROCUREMENT_CASDOOR_CLIENT_ID: inventory-app-client
      PROCUREMENT_CASDOOR_CLIENT_SECRET: inventory-app-secret-2026
      PROCUREMENT_CASDOOR_ORGANIZATION: inventory
      PROCUREMENT_CASDOOR_APP_NAME: inventory-app
      PROCUREMENT_CASDOOR_AUDIENCE: inventory-app-client
      PROCUREMENT_CASDOOR_ADMIN_USER: admin
      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: "123"

    ports:
      - "8001:8000"

    labels:
      - traefik.enable=true
      - traefik.http.routers.api.rule=Host(`${API_HOST:-api.localhost}`)
      - traefik.http.routers.api.entrypoints=web
      - traefik.http.services.api.loadbalancer.server.port=8000

    networks:
      - traefik_network
      - default

    depends_on:
      postgres:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully

    restart: unless-stopped

  frontend:
    build:
      context: ./frontend
      args:
        DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-true}

    ports:
      - "8085:80"

    labels:
      - traefik.enable=true
      - traefik.http.routers.frontend.rule=Host(`${APP_HOST:-localhost}`)
      - traefik.http.routers.frontend.entrypoints=web
      - traefik.http.services.frontend.loadbalancer.server.port=80

    networks:
      - traefik_network
      - default

    depends_on:
      - api

    restart: unless-stopped

networks:
  traefik_network:
    name: erp_production_network
    driver: bridge

volumes:
  postgres_data:
  minio_data:
  traefik_certs: