# wiki-tcg — replaces the previous docker-compose.yml, which did not describe
# the deployment (findings-02 §5.4).
#
# Networks:
#   proxy        - shared, created outside compose. NPM meets front-facing
#                  containers here. Also used by other stacks later.
#   tcg-internal - private. Only the backend and the database. Marked internal,
#                  so the database has no route off this network at all.
#
# Deploy:  docker compose up -d --build
# Migrate: docker compose run --rm backend alembic upgrade head

services:
  db:
    image: postgres:16
    container_name: wikitcg-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: wikitcg
      POSTGRES_USER: wikitcg
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
      PGDATA: /var/lib/postgresql/data
      TZ: Europe/Paris
    volumes:
      # EXACT path from the running container. /mnt/cache, NOT /mnt/user —
      # this deliberately bypasses Unraid's FUSE layer. Do not "correct" it.
      - /mnt/cache/appdata/postgresql16:/var/lib/postgresql/data
    networks:
      - tcg-internal
    # No ports. The database is unreachable from the host and the LAN.
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U wikitcg -d wikitcg"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  backend:
    build:
      context: ./backend
      dockerfile: dockerfile
    image: wikitcg-backend
    container_name: wikitcg-backend
    restart: unless-stopped
    environment:
      # Runtime connection — DML only, cannot alter schema.
      DATABASE_URL: postgresql://wikitcg_app:${APP_DB_PASSWORD:?}@db:5432/wikitcg
      # Migrations only. Owns the schema. Used by `compose run`, never by the
      # running app. See tcg-remediation-todo.md Task 5.
      MIGRATION_DATABASE_URL: postgresql://wikitcg:${POSTGRES_PASSWORD:?}@db:5432/wikitcg
      JWT_SECRET_KEY: ${JWT_SECRET_KEY:?}
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:?}
      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:?}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:?}
      RESEND_API_KEY: ${RESEND_API_KEY:?}
      EMAIL_FROM: noreply@tcg.gade.gg
      FRONTEND_URL: https://tcg.gade.gg
      CORS_ORIGINS: https://tcg.gade.gg
      WIKIRANK_USER_AGENT: WikiTCG/1.0 (nikolaj@gade.gg)
      TZ: Europe/Paris
    networks:
      - tcg-internal    # to reach db
      - proxy           # to be reached by NPM
    ports:
      # STAGE 1 ONLY. Remove once NPM points at backend:8000 by name.
      - "555:8000"
    depends_on:
      db:
        condition: service_healthy

  frontend:
    build:
      context: ./frontend
      dockerfile: dockerfile
      args:
        PUBLIC_API_URL: https://tcg-api.gade.gg
    image: wikitcg-frontend
    container_name: wikitcg-frontend
    restart: unless-stopped
    environment:
      TZ: Europe/Paris
    networks:
      - proxy           # NPM only. No database access, by construction.
    ports:
      # STAGE 1 ONLY. Remove once NPM points at frontend:80 by name.
      - "444:80"

networks:
  proxy:
    external: true
  tcg-internal:
    internal: true