# =============================================================================
# Customer Portal - Production Docker Compose
# =============================================================================
# Full stack for standalone production deployments (non-Portainer)
# For Portainer/Plesk, use docker/portainer/docker-compose.yml instead
# =============================================================================

services:
  # ---------------------------------------------------------------------------
  # Frontend (Next.js)
  # ---------------------------------------------------------------------------
  frontend:
    build:
      context: ../..
      dockerfile: apps/portal/Dockerfile
      args:
        - NODE_VERSION=22
        - PNPM_VERSION=${PNPM_VERSION:-10.25.0}
        - NEXT_PUBLIC_API_BASE=${NEXT_PUBLIC_API_BASE:-/api}
        - NEXT_PUBLIC_APP_NAME=${NEXT_PUBLIC_APP_NAME:-Customer Portal}
        - NEXT_PUBLIC_APP_VERSION=${NEXT_PUBLIC_APP_VERSION:-1.0.0}
    image: portal-frontend:${IMAGE_TAG:-latest}
    container_name: portal-frontend
    ports:
      - "${FRONTEND_PORT:-3000}:3000"
    environment:
      - NODE_ENV=production
      - PORT=3000
      - HOSTNAME=0.0.0.0
    restart: unless-stopped
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - portal-network
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:3000/api/health').then(r=>r.ok||process.exit(1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 10s
      start_period: 40s
      retries: 3

  # ---------------------------------------------------------------------------
  # Backend (NestJS BFF)
  # ---------------------------------------------------------------------------
  backend:
    build:
      context: ../..
      dockerfile: apps/bff/Dockerfile
      args:
        - NODE_VERSION=22
        - PNPM_VERSION=${PNPM_VERSION:-10.25.0}
        - PRISMA_VERSION=7.1.0
    image: portal-backend:${IMAGE_TAG:-latest}
    container_name: portal-backend
    ports:
      - "${BACKEND_PORT:-4000}:4000"
    environment:
      # Core
      - NODE_ENV=production
      - APP_NAME=${APP_NAME:-customer-portal-bff}
      - APP_BASE_URL=${APP_BASE_URL}
      - BFF_PORT=4000
      - PORT=4000
      
      # Database
      - DATABASE_URL=postgresql://${POSTGRES_USER:-portal}:${POSTGRES_PASSWORD}@database:5432/${POSTGRES_DB:-portal_prod}?schema=public
      
      # Redis
      - REDIS_URL=redis://cache:6379/0
      
      # Security
      - JWT_SECRET=${JWT_SECRET}
      - JWT_EXPIRES_IN=${JWT_EXPIRES_IN:-7d}
      - BCRYPT_ROUNDS=${BCRYPT_ROUNDS:-12}
      - CORS_ORIGIN=${CORS_ORIGIN}
      - TRUST_PROXY=true
      - CSRF_SECRET_KEY=${CSRF_SECRET_KEY}
      
      # Auth
      - AUTH_ALLOW_REDIS_TOKEN_FAILOPEN=${AUTH_ALLOW_REDIS_TOKEN_FAILOPEN:-false}
      - AUTH_REQUIRE_REDIS_FOR_TOKENS=${AUTH_REQUIRE_REDIS_FOR_TOKENS:-false}
      - AUTH_MAINTENANCE_MODE=${AUTH_MAINTENANCE_MODE:-false}
      
      # Rate Limiting
      - RATE_LIMIT_TTL=${RATE_LIMIT_TTL:-60}
      - RATE_LIMIT_LIMIT=${RATE_LIMIT_LIMIT:-100}
      - EXPOSE_VALIDATION_ERRORS=false
      
      # WHMCS
      - WHMCS_BASE_URL=${WHMCS_BASE_URL}
      - WHMCS_API_IDENTIFIER=${WHMCS_API_IDENTIFIER}
      - WHMCS_API_SECRET=${WHMCS_API_SECRET}
      
      # Salesforce
      - SF_LOGIN_URL=${SF_LOGIN_URL}
      - SF_CLIENT_ID=${SF_CLIENT_ID}
      - SF_USERNAME=${SF_USERNAME}
      - SF_EVENTS_ENABLED=${SF_EVENTS_ENABLED:-true}
      - SF_PRIVATE_KEY_BASE64=${SF_PRIVATE_KEY_BASE64}
      - SF_PRIVATE_KEY_PATH=/app/secrets/sf-private.key
      
      # Freebit
      - FREEBIT_BASE_URL=${FREEBIT_BASE_URL:-https://i1.mvno.net/emptool/api}
      - FREEBIT_OEM_ID=${FREEBIT_OEM_ID:-PASI}
      - FREEBIT_OEM_KEY=${FREEBIT_OEM_KEY}
      
      # Email
      - EMAIL_ENABLED=${EMAIL_ENABLED:-true}
      - EMAIL_FROM=${EMAIL_FROM:-no-reply@asolutions.jp}
      - EMAIL_FROM_NAME=${EMAIL_FROM_NAME:-Assist Solutions}
      - SENDGRID_API_KEY=${SENDGRID_API_KEY}
      
      # Portal
      - PORTAL_PRICEBOOK_ID=${PORTAL_PRICEBOOK_ID}
      - PORTAL_PRICEBOOK_NAME=${PORTAL_PRICEBOOK_NAME:-Portal}
      
      # Logging
      - LOG_LEVEL=${LOG_LEVEL:-info}
      
      # Migrations
      - RUN_MIGRATIONS=${RUN_MIGRATIONS:-true}
    restart: unless-stopped
    depends_on:
      database:
        condition: service_healthy
      cache:
        condition: service_healthy
    networks:
      - portal-network
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://localhost:4000/health').then(r=>r.ok||process.exit(1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 3

  # ---------------------------------------------------------------------------
  # PostgreSQL Database
  # ---------------------------------------------------------------------------
  database:
    image: postgres:17-alpine
    container_name: portal-database
    environment:
      - POSTGRES_DB=${POSTGRES_DB:-portal_prod}
      - POSTGRES_USER=${POSTGRES_USER:-portal}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_INITDB_ARGS=--encoding=UTF-8 --lc-collate=C --lc-ctype=C
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    networks:
      - portal-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-portal} -d ${POSTGRES_DB:-portal_prod}"]
      interval: 10s
      timeout: 5s
      start_period: 30s
      retries: 5

  # ---------------------------------------------------------------------------
  # Redis Cache
  # ---------------------------------------------------------------------------
  cache:
    image: redis:7-alpine
    container_name: portal-cache
    command: ["redis-server", "--save", "60", "1", "--loglevel", "warning", "--maxmemory", "128mb", "--maxmemory-policy", "allkeys-lru"]
    volumes:
      - redis_data:/data
    restart: unless-stopped
    networks:
      - portal-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local

networks:
  portal-network:
    driver: bridge