ERP/docker-compose.yml

services:
  postgres:
    image: postgres:18
    container_name: procurement-postgres

    environment:
      POSTGRES_DB: procurement
      POSTGRES_USER: postgres
      # Local dev default; production overrides via .env (required by the
      # prod overlay) — never commit real passwords.
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}

    ports:
      - "5433:5432"

    volumes:
      - postgres_data:/var/lib/postgresql
      - ./sql/migration.sql:/docker-entrypoint-initdb.d/01-migration.sql:ro
      - ./sql/02-casdoor-db.sql:/docker-entrypoint-initdb.d/02-casdoor-db.sql:ro

    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d procurement"]
      interval: 5s
      timeout: 5s
      retries: 10

    restart: unless-stopped

  # ==========================================================================
  # Traefik v3 — public reverse proxy (replaces nginx as the edge)
  # App is served on http://localhost (port 80) instead of :3000.
  # Production: see docker-compose.prod.yml (real domains + HTTPS via
  # Let's Encrypt, HTTP→HTTPS redirect).
  # ==========================================================================
  traefik:
    # v3.6+ required: Traefik ≤3.3 fails against Docker Engine 29.x
    # ("Error response from daemon" — Docker API version mismatch).
    image: traefik:v3.6
    container_name: procurement-traefik
    restart: unless-stopped
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      # Containers are on several networks; Traefik must use the dedicated
      # proxy network IP (otherwise it may pick the default-network IP → 504).
      - --providers.docker.network=traefik_network
      - --providers.file.filename=/etc/traefik/dynamic.yml
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL:-admin@example.com}
      - --certificatesresolvers.letsencrypt.acme.storage=/certs/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
      - --log.level=INFO
    ports:
      - "80:80"
      - "443:443"
    volumes:
      # NOTE: mounted read-write — Docker Desktop rejects read-only
      # /var/run/docker.sock mounts ("Error response from daemon").
      - /var/run/docker.sock:/var/run/docker.sock
      - ./infra/traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro
      - traefik_certs:/certs
    networks:
      - traefik_network

  minio:
    image: minio/minio:latest
    container_name: procurement-minio

    command: server /data --console-address ":9001"

    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}

    ports:
      - "9000:9000"   # S3 API
      - "9001:9001"   # Web console

    volumes:
      - minio_data:/data

    labels:
      - traefik.enable=true
      # S3 API
      - traefik.http.routers.minio-api.rule=Host(`${S3_HOST:-s3.localhost}`)
      - traefik.http.routers.minio-api.entrypoints=web
      - traefik.http.routers.minio-api.service=minio-api-svc
      - traefik.http.services.minio-api-svc.loadbalancer.server.port=9000
      # Web console
      - traefik.http.routers.minio-console.rule=Host(`${STORAGE_HOST:-storage.localhost}`)
      - traefik.http.routers.minio-console.entrypoints=web
      - traefik.http.routers.minio-console.service=minio-console-svc
      - traefik.http.services.minio-console-svc.loadbalancer.server.port=9001

    networks:
      - traefik_network
      - default

    restart: unless-stopped

  # MinIO Client (mc): waits for the server, creates the bucket, exits.
  # Use for ad-hoc ops too: docker compose run --rm minio-init ...
  minio-init:
    image: minio/mc:latest
    container_name: procurement-minio-init

    depends_on:
      minio:
        condition: service_started

    environment:
      MINIO_ENDPOINT: minio:9000
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-minioadmin}
      MINIO_BUCKET: procurement-files

    entrypoint: >
      /bin/sh -c "
      until mc alias set local http://$${MINIO_ENDPOINT} $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD}; do
        echo 'waiting for minio server...'; sleep 2;
      done;
      mc mb --ignore-existing local/$${MINIO_BUCKET};
      echo bucket $${MINIO_BUCKET} ready;
      "

    restart: "no"

  # ==========================================================================
  # v2.6 — Casdoor (OIDC identity provider)
  # Console: http://localhost:8080 (admin / 123)
  # Application "inventory-app" (org "inventory", client inventory-app-client)
  # is created by backend/tools/seed_casdoor.py — run it once after the
  # first boot:
  #   docker compose run --rm -e CASDOOR_BASE=http://casdoor:8000 api python tools/seed_casdoor.py
  #
  # Casdoor uses the SAME postgres instance as the app (database `casdoor`,
  # created by sql/02-casdoor-db.sql on a fresh volume).
  # ==========================================================================
  casdoor:
    image: casbin/casdoor:latest
    container_name: procurement-casdoor
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      RUNNING_IN_DOCKER: "true"
      driverName: postgres
      dataSourceName: "user=casdoor password=casdoor host=postgres port=5432 sslmode=disable dbname=casdoor"
      dbName: casdoor
      origin: "http://localhost:8080"
    ports:
      - "8080:8000"

    labels:
      - traefik.enable=true
      - traefik.http.routers.casdoor.rule=Host(`${AUTH_HOST:-auth.localhost}`)
      - traefik.http.routers.casdoor.entrypoints=web
      - traefik.http.services.casdoor.loadbalancer.server.port=8000

    networks:
      - traefik_network
      - default

    restart: unless-stopped

  api:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: procurement-api

    environment:
      PROCUREMENT_DATABASE_URL: postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/procurement
      PROCUREMENT_MINIO_ENDPOINT: minio:9000
      PROCUREMENT_MINIO_ACCESS_KEY: ${MINIO_ROOT_USER:-minioadmin}
      PROCUREMENT_MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD:-minioadmin}
      PROCUREMENT_MINIO_BUCKET: procurement-files
      PROCUREMENT_MINIO_SECURE: "false"
      # "dev" enables the local defaults; "prod" turns on the fail-fast
      # startup checks (no wildcard CORS, no default credentials).
      PROCUREMENT_ENVIRONMENT: ${ENVIRONMENT:-dev}
      PROCUREMENT_DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-false}
      # Comma-separated browser origins (JSON-free .env friendly).
      PROCUREMENT_CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost,http://localhost:3000,http://localhost:5173}
      # Casdoor: endpoint is the in-network service URL; the issuer must match
      # the origin Casdoor advertises to browsers (its OIDC discovery doc).
      PROCUREMENT_CASDOOR_ENDPOINT: http://casdoor:8000
      PROCUREMENT_CASDOOR_ISSUER: ${CASDOOR_ISSUER:-http://localhost:8080}
      PROCUREMENT_CASDOOR_CLIENT_ID: inventory-app-client
      PROCUREMENT_CASDOOR_CLIENT_SECRET: ${CASDOOR_CLIENT_SECRET:-inventory-app-secret-2026}
      PROCUREMENT_CASDOOR_ORGANIZATION: inventory
      PROCUREMENT_CASDOOR_APP_NAME: inventory-app
      PROCUREMENT_CASDOOR_AUDIENCE: inventory-app-client
      # Console admin used by POST /users/sync (identity mirroring).
      PROCUREMENT_CASDOOR_ADMIN_USER: admin
      PROCUREMENT_CASDOOR_ADMIN_PASSWORD: ${CASDOOR_ADMIN_PASSWORD:-123}

    ports:
      - "8000:8000"

    labels:
      - traefik.enable=true
      - traefik.http.routers.api.rule=Host(`${API_HOST:-api.localhost}`)
      - traefik.http.routers.api.entrypoints=web
      - traefik.http.services.api.loadbalancer.server.port=8000

    networks:
      - traefik_network
      - default

    depends_on:
      postgres:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully

    restart: unless-stopped

  frontend:
    build:
      context: ./frontend
      args:
        # Developer Mode panel on the login page — dev-only aid. Production
        # builds MUST leave this false (identity comes from Casdoor tokens).
        DEV_LOGIN_ENABLED: ${DEV_LOGIN_ENABLED:-false}
    container_name: procurement-frontend

    labels:
      - traefik.enable=true
      - traefik.http.routers.frontend.rule=Host(`${APP_HOST:-localhost}`)
      - traefik.http.routers.frontend.entrypoints=web
      - traefik.http.services.frontend.loadbalancer.server.port=80

    networks:
      - traefik_network
      - default

    depends_on:
      - api

    restart: unless-stopped

networks:
  # شبکه‌ی عمومی: فقط ترافیک و سرویس‌های عمومی. postgres روی شبکه‌ی
  # پیش‌فرض می‌ماند و از بیرون قابل دسترسی نیست.
  traefik_network:
    name: traefik_network
    driver: bridge

volumes:
  postgres_data:
  minio_data:
  traefik_certs: