# =============================================================================
# docker-compose.yml — LeoCRM Multi-Container Setup
#
# Full stack: PostgreSQL + Redis + App + Worker, all with persistent volumes.
#
# This file serves two purposes:
# 1. Local development / testing: `docker compose up --build`
# 2. Reference for the production multi-container architecture
#
# Production deploys via Coolify use scripts/deploy.py which automates:
#   - Coolify API build & deploy
#   - Persistent volume mounting (patched into Coolify's generated compose)
#   - Worker container startup
#   - RLS policy enforcement
#   - Health & domain verification
#
# No hardcoded secrets, UUIDs, or domains — everything from environment.
#
# Usage (local testing):
#   cp .env.example .env
#   $EDITOR .env          # fill SECRET_KEY, DB_PASSWORD, REDIS_PASSWORD, ...
#   docker compose up --build
#   curl http://localhost:8000/api/v1/health
# =============================================================================

services:
  # ── PostgreSQL 16 with pgvector ─────────────────────────────────────
  postgres:
    image: pgvector/pgvector:pg16
    container_name: ${POSTGRES_CONTAINER_NAME:-crm-postgres}
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-crm_user}
      POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD is required}
      POSTGRES_DB: ${POSTGRES_DB:-crm_db}
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - pgdata:/var/lib/postgresql/data
    # No exposed ports — only internal Docker network access
    # For local debugging, uncomment: ports: ["127.0.0.1:5432:5432"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-crm_user} -d ${POSTGRES_DB:-crm_db}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "2.0"
    networks:
      - crm-net

  # ── Redis 7 (sessions, rate limiting, ARQ queue) ────────────────────
  redis:
    image: redis:7-alpine
    container_name: ${REDIS_CONTAINER_NAME:-crm-redis}
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
    volumes:
      - redisdata:/data
    # No exposed ports — only internal Docker network access
    # For local debugging, uncomment: ports: ["127.0.0.1:6379:6379"]
    healthcheck:
      test: ["CMD-SHELL", "redis-cli ping || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - crm-net

  # ── CRM API (FastAPI + Uvicorn) ─────────────────────────────────────
  crm-app:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: ${APP_CONTAINER_NAME:-crm-app}
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.routers.crm.rule=Host(`${APP_HOST:-crm.media-on.de}`)
      - traefik.http.routers.crm.entryPoints=http,https
      - traefik.http.routers.crm.tls=true
      - traefik.http.routers.crm.tls.certresolver=letsencrypt
      - traefik.http.services.crm.loadbalancer.server.port=${APP_PORT:-8000}
    networks:
      - crm-net
      - coolify
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      # API uses crm_api (NOSUPERUSER, NOBYPASSRLS) — RLS enforced
      DATABASE_URL: ${DATABASE_URL:-postgresql+asyncpg://crm_api:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
      # Auth uses crm_auth (NOSUPERUSER, NOBYPASSRLS) — identity tables only
      AUTH_DATABASE_URL: ${AUTH_DATABASE_URL:-postgresql+asyncpg://crm_auth:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
      # Migration/DDL uses crm_migration (owner, NOBYPASSRLS)
      MIGRATION_DATABASE_URL: ${MIGRATION_DATABASE_URL:-postgresql+asyncpg://crm_migration:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
      REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD}@redis:6379/0}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
      CORS_ORIGINS: ${CORS_ORIGINS:-${APP_DOMAIN:-http://localhost:8000}}
      FRONTEND_URL: ${FRONTEND_URL:-${APP_DOMAIN:-http://localhost:8000}}
      ENVIRONMENT: ${ENVIRONMENT:-production}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-true}
      STORAGE_PATH: ${STORAGE_PATH:-/data/storage}
      # SMTP for password reset and notifications
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM: ${SMTP_FROM:-no-reply@localhost}
      SMTP_TLS: ${SMTP_TLS:-true}
      BCRYPT_ROUNDS: ${BCRYPT_ROUNDS:-12}
      # S3 Storage (optional — if STORAGE_BACKEND=s3)
      STORAGE_BACKEND: ${STORAGE_BACKEND:-local}
      S3_ENDPOINT: ${S3_ENDPOINT:-}
      S3_BUCKET: ${S3_BUCKET:-}
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-}
      S3_SECRET_KEY: ${S3_SECRET_KEY:-}
      S3_REGION: ${S3_REGION:-us-east-1}
      S3_SECURE: ${S3_SECURE:-true}
    # No exposed ports — accessed via reverse proxy
    volumes:
      - storage:/data/storage
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:${APP_PORT:-8000}/api/v1/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "2.0"

  # ── CRM Worker (ARQ background jobs, cron, outbox processor) ───────
  crm-worker:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: ${WORKER_CONTAINER_NAME:-crm-worker}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    entrypoint: ["/app/worker.sh"]
    healthcheck:
      test: ["CMD-SHELL", "python3 -c \"import redis,os; r=redis.from_url(os.environ.get('REDIS_URL','redis://localhost:6379/0')); print('ok' if r.ping() else 'fail')\" || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "1.0"
    environment:
      # Worker uses crm_worker (NOSUPERUSER, NOBYPASSRLS) — RLS enforced
      DATABASE_URL: ${WORKER_DATABASE_URL:-postgresql+asyncpg://crm_worker:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
      WORKER_DATABASE_URL: ${WORKER_DATABASE_URL:-postgresql+asyncpg://crm_worker:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
      MIGRATION_DATABASE_URL: ${MIGRATION_DATABASE_URL:-postgresql+asyncpg://crm_migration:${DB_PASSWORD}@postgres:5432/${POSTGRES_DB:-crm_db}}
      REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD}@redis:6379/0}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
      FRONTEND_URL: ${FRONTEND_URL:-${APP_DOMAIN:-http://localhost:8000}}
      ENVIRONMENT: ${ENVIRONMENT:-production}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-true}
      STORAGE_PATH: ${STORAGE_PATH:-/data/storage}
      # SMTP for password reset and notifications
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM: ${SMTP_FROM:-no-reply@localhost}
      SMTP_TLS: ${SMTP_TLS:-true}
      STORAGE_BACKEND: ${STORAGE_BACKEND:-local}
      S3_ENDPOINT: ${S3_ENDPOINT:-}
      S3_BUCKET: ${S3_BUCKET:-}
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-}
      S3_SECRET_KEY: ${S3_SECRET_KEY:-}
    volumes:
      - storage:/data/storage
    networks:
      - crm-net

volumes:
  pgdata:
    name: ${PGDATA_VOLUME_NAME:-crm_pgdata}
  redisdata:
    name: ${REDISDATA_VOLUME_NAME:-crm_redisdata}
  storage:
    name: ${STORAGE_VOLUME_NAME:-crm_storage}

networks:
  crm-net:
    name: ${CRM_NETWORK_NAME:-crm-net}
    driver: bridge
  coolify:
    name: ${COOLIFY_NETWORK_NAME:-coolify}
    external: true