name: sass-mohfarawati

services:
  app:
    init: true
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    environment:
      NODE_ENV: production
      NEXT_TELEMETRY_DISABLED: "1"
      NEXT_PUBLIC_SITE_URL: ${NEXT_PUBLIC_SITE_URL:-https://mohfarawati.de}
      NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL:-https://root.mohfarawati.de}
      ADMIN_HOST: ${ADMIN_HOST:-root.mohfarawati.de}
      SITE_RUNTIME_ORIGIN: ${SITE_RUNTIME_ORIGIN:-http://127.0.0.1:3000}
      DATABASE_URL: postgresql://postgres:postgres@db:5432/moh_sass
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?ADMIN_PASSWORD must be set in .env}
      ADMIN_AUTH_SECRET: ${ADMIN_AUTH_SECRET:?ADMIN_AUTH_SECRET must be set in .env (use a long random string)}
      ADMIN_BASIC_AUTH_USER: ${ADMIN_BASIC_AUTH_USER:?ADMIN_BASIC_AUTH_USER must be set in .env}
      ADMIN_BASIC_AUTH_PASS: ${ADMIN_BASIC_AUTH_PASS:?ADMIN_BASIC_AUTH_PASS must be set in .env}
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1:3000/api/health || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 20s
    labels:
      - traefik.enable=true
      - traefik.docker.network=${TRAEFIK_NETWORK:-proxy}
      # HTTPS router — public site + www + admin subdomain all hit this one app;
      # the app's middleware routes root.mohfarawati.de to the admin internally.
      - "traefik.http.routers.sass.rule=Host(`mohfarawati.de`) || Host(`www.mohfarawati.de`) || Host(`root.mohfarawati.de`)"
      - traefik.http.routers.sass.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
      - traefik.http.routers.sass.tls=true
      - traefik.http.routers.sass.tls.certresolver=${TRAEFIK_CERTRESOLVER:-cf}
      - traefik.http.services.sass.loadbalancer.server.port=3000
      # HTTP router → redirect to HTTPS
      - "traefik.http.routers.sass-http.rule=Host(`mohfarawati.de`) || Host(`www.mohfarawati.de`) || Host(`root.mohfarawati.de`)"
      - traefik.http.routers.sass-http.entrypoints=web
      - traefik.http.routers.sass-http.middlewares=sass-redirect
      - traefik.http.middlewares.sass-redirect.redirectscheme.scheme=https
    volumes:
      - media_uploads:/app/public/uploads/media
    networks:
      - proxy
      - appnet

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: moh_sass
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d moh_sass"]
      interval: 5s
      timeout: 5s
      retries: 20
    networks:
      - appnet

volumes:
  postgres_data:
  media_uploads:

networks:
  appnet:
  # Shared external Traefik network (same one the other projects use).
  # Override the name per server with TRAEFIK_NETWORK in .env.
  proxy:
    external: true
    name: ${TRAEFIK_NETWORK:-proxy}