# Production stack — EVERYTHING on one server:
#   Caddy (TLS) ── serves the frontend SPA and proxies /api + /uploads to the backend
#   backend (ASP.NET Core) ── MongoDB (authenticated, not exposed) + uploads volume
#
# Usage on the server:
#   cp .env.production.example .env   # then edit all values (domain, secrets, VITE_*)
#   docker compose -f docker-compose.prod.yml up -d --build

services:
  mongo:
    image: mongo:7
    container_name: foz-fc-mongo
    restart: always
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${MONGO_USER}
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD}
    volumes:
      - mongo_data:/data/db
    # No published ports: MongoDB is only reachable on the internal Docker network.
    healthcheck:
      test:
        [
          "CMD", "mongosh", "--quiet",
          "-u", "${MONGO_USER}", "-p", "${MONGO_PASSWORD}",
          "--authenticationDatabase", "admin",
          "--eval", "db.adminCommand('ping')"
        ]
      interval: 10s
      timeout: 5s
      retries: 5

  backend:
    build: ./backend
    container_name: foz-fc-backend
    restart: always
    depends_on:
      mongo:
        condition: service_healthy
    environment:
      PORT: 4000
      MONGODB_URI: mongodb://${MONGO_USER}:${MONGO_PASSWORD}@mongo:27017/?authSource=admin
      MONGODB_DB: ${MONGO_DB:-foz_fc}
      JWT_SECRET: ${JWT_SECRET}
      JWT_TTL_SECONDS: ${JWT_TTL_SECONDS:-2592000}
      # Same-origin in production, so CORS is not strictly needed; kept for safety.
      CORS_ORIGINS: ${CORS_ORIGINS:-https://${DOMAIN}}
      FIREBASE_PROJECT_ID: ${FIREBASE_PROJECT_ID}
      PUBLIC_BASE_URL: https://${DOMAIN}
      ALLOW_UNVERIFIED_GOOGLE: "false"
      SEED_ADMIN_EMAIL: ${SEED_ADMIN_EMAIL}
      SEED_ADMIN_PASSWORD: ${SEED_ADMIN_PASSWORD}
      ASPNETCORE_ENVIRONMENT: Production
    volumes:
      - uploads_data:/app/uploads
    expose:
      - "4000"   # internal only; Caddy proxies to it

  frontend:
    build:
      context: ./frontend
      args:
        # Same origin => call the API at a relative path (no CORS).
        VITE_API_BASE_URL: /api
        VITE_FIREBASE_API_KEY: ${VITE_FIREBASE_API_KEY:-}
        VITE_FIREBASE_AUTH_DOMAIN: ${VITE_FIREBASE_AUTH_DOMAIN:-}
        VITE_FIREBASE_PROJECT_ID: ${VITE_FIREBASE_PROJECT_ID:-}
        VITE_FIREBASE_STORAGE_BUCKET: ${VITE_FIREBASE_STORAGE_BUCKET:-}
        VITE_FIREBASE_MESSAGING_SENDER_ID: ${VITE_FIREBASE_MESSAGING_SENDER_ID:-}
        VITE_FIREBASE_APP_ID: ${VITE_FIREBASE_APP_ID:-}
        VITE_FIREBASE_MEASUREMENT_ID: ${VITE_FIREBASE_MEASUREMENT_ID:-}
        VITE_GOOGLE_AUTH_CLIENT_ID: ${VITE_GOOGLE_AUTH_CLIENT_ID:-}
        VITE_RECAPTCHA_SITE_KEY: ${VITE_RECAPTCHA_SITE_KEY:-}
        VITE_FIREBASE_APPCHECK_SITE_KEY: ${VITE_FIREBASE_APPCHECK_SITE_KEY:-}
        VITE_ZEROZERO_PROXY_BASE_URL: ${VITE_ZEROZERO_PROXY_BASE_URL:-}
        VITE_CTT_TRACKING_WORKER_URL: ${VITE_CTT_TRACKING_WORKER_URL:-}
        VITE_CREATE_CHECKOUT_SESSION_URL: ${VITE_CREATE_CHECKOUT_SESSION_URL:-}
    container_name: foz-fc-frontend
    restart: always
    expose:
      - "80"     # internal only; Caddy proxies to it

  caddy:
    image: caddy:2
    container_name: foz-fc-caddy
    restart: always
    depends_on:
      - backend
      - frontend
    ports:
      - "80:80"
      - "443:443"
    environment:
      DOMAIN: ${DOMAIN}
      ACME_EMAIL: ${ACME_EMAIL}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config

volumes:
  mongo_data:
  uploads_data:
  caddy_data:
  caddy_config:
