version: "3.9"

services:
  postgres:
    image: postgres:16-alpine
    container_name: cardsync_db
    restart: unless-stopped
    environment:
      POSTGRES_DB: cardsync
      POSTGRES_USER: cardsync
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U cardsync"]
      interval: 10s
      timeout: 5s
      retries: 5

  backend:
    build: ./backend
    container_name: cardsync_backend
    restart: unless-stopped
    environment:
      DATABASE_URL: postgresql://cardsync:${POSTGRES_PASSWORD:-changeme}@postgres:5432/cardsync
      SECRET_KEY: ${SECRET_KEY:-supersecretkey_change_in_production}
      MS_CLIENT_ID: ${MS_CLIENT_ID}
      MS_CLIENT_SECRET: ${MS_CLIENT_SECRET}
      MS_TENANT_ID: ${MS_TENANT_ID:-common}
      APP_BASE_URL: ${APP_BASE_URL:-https://localhost}
      ADMIN_EMAILS: ${ADMIN_EMAILS}
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./backend:/app
    ports:
      - "8000:8000"

  frontend:
    image: nginx:alpine
    container_name: cardsync_frontend
    restart: unless-stopped
    volumes:
      - ./frontend:/usr/share/nginx/html:ro
      - ./nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - cardsync_certs:/etc/nginx/certs
      - ./nginx/certs:/etc/nginx/custom-certs:ro
    ports:
      - "80:80"
      - "443:443"
    depends_on:
      - backend
    # Beim Start: Eigenes Cert aus ./nginx/certs übernehmen falls vorhanden,
    # sonst selbstsigniertes generieren, dann nginx starten
    command: >
      /bin/sh -c "
      if [ -f /etc/nginx/custom-certs/cert.pem ] && [ -f /etc/nginx/custom-certs/key.pem ]; then
        echo '==> Verwende eigenes Zertifikat aus ./nginx/certs/';
        cp /etc/nginx/custom-certs/cert.pem /etc/nginx/certs/cert.pem;
        cp /etc/nginx/custom-certs/key.pem /etc/nginx/certs/key.pem;
        chmod 644 /etc/nginx/certs/cert.pem;
        chmod 600 /etc/nginx/certs/key.pem;
      elif [ ! -f /etc/nginx/certs/cert.pem ]; then
        echo '==> Generiere selbstsigniertes Zertifikat (10 Jahre Laufzeit)';
        mkdir -p /etc/nginx/certs;
        openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/certs/key.pem -out /etc/nginx/certs/cert.pem -days 3650 -subj '/CN=cardsync.local/O=CardSync/C=DE' -addext 'subjectAltName=DNS:cardsync.local,DNS:localhost,IP:127.0.0.1' 2>/dev/null;
        chmod 644 /etc/nginx/certs/cert.pem;
        chmod 600 /etc/nginx/certs/key.pem;
      else
        echo '==> Verwende vorhandenes Zertifikat aus Volume';
      fi;
      exec nginx -g 'daemon off;'
      "

volumes:
  postgres_data:
  cardsync_certs: