# Rapport-Server — Komplettstack für Self-Hosting.
#
# Bevor `docker compose up`:
#   1. cp .env.example .env  und Secrets ersetzen
#   2. ./scripts/sync-migrations.sh  (holt SQL aus dem App-Repo)
#
# Dann:
#   docker compose up -d
#
# Erststart dauert ~1 Min (Postgres bootet, Migrations laufen, Health-Checks).

services:
  # ════════════════════════════════════════════════════════════════════════
  # Postgres — Datenbank mit Supabase-Extensions
  # ════════════════════════════════════════════════════════════════════════
  db:
    image: supabase/postgres:15.8.1.020
    container_name: rapport-db
    restart: unless-stopped
    environment:
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: postgres
      JWT_SECRET: ${JWT_SECRET}
      JWT_EXP: 3600
    volumes:
      - postgres-data:/var/lib/postgresql/data
      # Rapport-Migrations gehen in einen separaten Pfad — NICHT in
      # /docker-entrypoint-initdb.d, weil das die supabase-internen Migrations
      # des Images überschreiben würde.
      - ./volumes/db/init/rapport-migrations:/rapport-migrations:ro
      # Post-Init läuft alphabetisch nach migrate.sh des Images. Achtung:
      # ASCII-Reihenfolge ist 0-9 < A-Z < a-z, daher "99-…" käme VOR "migrate.sh".
      # Mit "zz-…" landen wir sicher zuletzt.
      - ./volumes/db/init/zz-rapport-post-init.sh:/docker-entrypoint-initdb.d/zz-rapport-post-init.sh:ro
    ports:
      # Bewusst nur auf 127.0.0.1 — Postgres wird ueber Kong / interne
      # Container-Kommunikation erreicht, kein direkter LAN-Zugriff.
      - "127.0.0.1:${DB_PORT:-5432}:5432"
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "supabase_admin", "-d", "postgres"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 30s

  # ════════════════════════════════════════════════════════════════════════
  # GoTrue — Auth (Email-Login, Passwort-Reset, Magic-Links)
  # ════════════════════════════════════════════════════════════════════════
  auth:
    image: supabase/gotrue:v2.158.1
    container_name: rapport-auth
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      GOTRUE_API_HOST: 0.0.0.0
      GOTRUE_API_PORT: 9999
      API_EXTERNAL_URL: ${API_EXTERNAL_URL}
      GOTRUE_DB_DRIVER: postgres
      GOTRUE_DB_DATABASE_URL: postgres://supabase_auth_admin:${POSTGRES_PASSWORD}@db:5432/postgres
      GOTRUE_SITE_URL: ${SITE_URL}
      GOTRUE_URI_ALLOW_LIST: ${SITE_URL},${SITE_URL}/
      GOTRUE_DISABLE_SIGNUP: "false"
      GOTRUE_JWT_ADMIN_ROLES: service_role
      GOTRUE_JWT_AUD: authenticated
      GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
      GOTRUE_JWT_EXP: 3600
      GOTRUE_JWT_SECRET: ${JWT_SECRET}
      GOTRUE_EXTERNAL_EMAIL_ENABLED: "true"
      GOTRUE_MAILER_AUTOCONFIRM: "true"
      GOTRUE_SMTP_HOST: ${SMTP_HOST:-}
      GOTRUE_SMTP_PORT: ${SMTP_PORT:-587}
      GOTRUE_SMTP_USER: ${SMTP_USER:-}
      GOTRUE_SMTP_PASS: ${SMTP_PASS:-}
      GOTRUE_SMTP_ADMIN_EMAIL: ${SMTP_ADMIN_EMAIL:-admin@rapport.local}
      GOTRUE_SMTP_SENDER_NAME: ${SMTP_SENDER_NAME:-Rapport}

  # ════════════════════════════════════════════════════════════════════════
  # PostgREST — REST-API auf der Datenbank
  # ════════════════════════════════════════════════════════════════════════
  rest:
    image: postgrest/postgrest:v12.2.0
    container_name: rapport-rest
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      PGRST_DB_URI: postgres://authenticator:${POSTGRES_PASSWORD}@db:5432/postgres
      PGRST_DB_SCHEMAS: public,storage
      PGRST_DB_ANON_ROLE: anon
      PGRST_JWT_SECRET: ${JWT_SECRET}
      PGRST_DB_USE_LEGACY_GUCS: "false"
      PGRST_APP_SETTINGS_JWT_SECRET: ${JWT_SECRET}
      PGRST_APP_SETTINGS_JWT_EXP: 3600

  # ════════════════════════════════════════════════════════════════════════
  # Realtime — Postgres-Changes-Broadcast für Live-Sync
  # ════════════════════════════════════════════════════════════════════════
  realtime:
    image: supabase/realtime:v2.30.34
    container_name: rapport-realtime
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    ulimits:
      nofile:
        soft: 10000
        hard: 10000
    environment:
      PORT: 4000
      DB_HOST: db
      DB_PORT: 5432
      DB_USER: supabase_admin
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      DB_NAME: postgres
      DB_AFTER_CONNECT_QUERY: 'SET search_path TO realtime'
      DB_ENC_KEY: supabaserealtime
      API_JWT_SECRET: ${JWT_SECRET}
      SECRET_KEY_BASE: ${JWT_SECRET}
      ERL_AFLAGS: -proto_dist inet_tcp
      ENABLE_TAILSCALE: "false"
      DNS_NODES: "''"
      RLIMIT_NOFILE: 10000
      APP_NAME: realtime
      SEED_SELF_HOST: "true"
    command: >
      sh -c "/app/bin/migrate && /app/bin/realtime eval 'Realtime.Release.seeds(Realtime.Repo)' && /app/bin/server"

  # ════════════════════════════════════════════════════════════════════════
  # Storage — Object-Storage für Bilder (Quittungen, Logos)
  # ════════════════════════════════════════════════════════════════════════
  storage:
    image: supabase/storage-api:v1.11.13
    container_name: rapport-storage
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      rest:
        condition: service_started
    environment:
      ANON_KEY: ${ANON_KEY}
      SERVICE_KEY: ${SERVICE_ROLE_KEY}
      POSTGREST_URL: http://rest:3000
      PGRST_JWT_SECRET: ${JWT_SECRET}
      DATABASE_URL: postgres://supabase_storage_admin:${POSTGRES_PASSWORD}@db:5432/postgres
      FILE_SIZE_LIMIT: 52428800
      STORAGE_BACKEND: file
      FILE_STORAGE_BACKEND_PATH: /var/lib/storage
      TENANT_ID: stub
      REGION: stub
      GLOBAL_S3_BUCKET: stub
    volumes:
      - storage-data:/var/lib/storage

  # ════════════════════════════════════════════════════════════════════════
  # Kong — API-Gateway: bündelt alle Services unter einer URL
  # ════════════════════════════════════════════════════════════════════════
  kong:
    image: kong:2.8.1
    container_name: rapport-kong
    restart: unless-stopped
    depends_on:
      - auth
      - rest
      - storage
      - realtime
    environment:
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: /var/lib/kong/kong.yml
      KONG_DNS_ORDER: LAST,A,CNAME
      KONG_PLUGINS: request-transformer,cors,key-auth,acl,basic-auth
    volumes:
      - ./kong.yml:/var/lib/kong/kong.yml:ro
    ports:
      - "${KONG_HTTP_PORT:-8000}:8000"
      - "${KONG_HTTPS_PORT:-8443}:8443"

  # ════════════════════════════════════════════════════════════════════════
  # Rapport Frontend — die React-App hinter nginx
  # ════════════════════════════════════════════════════════════════════════
  app:
    # Default: aus Gitea-Registry pullen (`docker compose pull` reicht).
    # Wer das Image selber bauen will (Dev): RAPPORT_APP_IMAGE in .env auf
    # `rapport-app:main` setzen, dann `docker compose --profile build build app`.
    image: ${RAPPORT_APP_IMAGE:-git.kgva.ch/karim/rapport-app}:${RAPPORT_APP_TAG:-main}
    build:
      context: .
      dockerfile: Dockerfile.app
      args:
        RAPPORT_APP_TAG: ${RAPPORT_APP_TAG:-main}
        SUPABASE_URL: ${API_EXTERNAL_URL}
        SUPABASE_ANON_KEY: ${ANON_KEY}
    container_name: rapport-server-app
    restart: unless-stopped
    ports:
      - "${APP_PORT:-8080}:80"

volumes:
  postgres-data:
  storage-data: