version: '3.8'

services:
  # Traefik reverse proxy avec SSL automatique FONCTIONNEL
  traefik:
    image: traefik:v3.0
    container_name: faildaily-traefik-ssl
    restart: unless-stopped
    command:
      - "--api.dashboard=true"
      - "--api.insecure=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      # ============================================
      # CONFIGURATION TLS/SSL SÉCURISÉE
      # ============================================
      - "--entrypoints.websecure.http.tls.options=default"
      # ============================================
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=faildaily_faildaily-ssl-network"
      - "--certificatesresolvers.letsencrypt.acme.email=bruno@taaazzz.be"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      # Configuration TLS avancée pour Let's Encrypt
      - "--certificatesresolvers.letsencrypt.acme.keyType=EC256"
      - "--log.level=INFO"
      - "--accesslog=true"
      # ============================================
      # EN-TÊTES DE SÉCURITÉ GLOBAUX
      # ============================================
      - "--entrypoints.websecure.http.middlewares=security-headers@docker"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - faildaily_traefik-ssl-certs:/letsencrypt
    networks:
      - faildaily-ssl-network

  # Backend API avec SSL
  backend:
    build:
      context: ./backend-api
      dockerfile: ../docker/production/backend.prod.Dockerfile
    container_name: faildaily-backend-ssl
    restart: unless-stopped
    depends_on:
      - db
      - logs_db
    environment:
      - NODE_ENV=production
      - PORT=3000
      # Base de données application
      - DB_HOST=db
      - DB_PORT=3306
      - DB_USER=faildaily_user
      - DB_PASSWORD=${DB_PASSWORD}
      - DB_NAME=faildaily
      # Base de données logs séparée
      - LOGS_DB_HOST=logs_db
      - LOGS_DB_PORT=3306
      - LOGS_DB_USER=logs_user
      - LOGS_DB_PASSWORD=${LOGS_DB_PASSWORD}
      - LOGS_DB_NAME=faildaily_logs
      - JWT_SECRET=${JWT_SECRET}
      - CORS_ORIGIN=https://faildaily.com,https://www.faildaily.com
      - RATE_LIMIT_WINDOW=15
      - RATE_LIMIT_MAX_REQUESTS=1000
      # Configuration SMTP pour l'envoi d'emails
      - SMTP_HOST=ssl0.ovh.net
      - SMTP_PORT=587
      - SMTP_SECURE=false
      - SMTP_USER=contact@taaazzz-prog.fr
      - SMTP_PASS=${SMTP_PASSWORD}
      - SMTP_FROM=FailDaily <contact@taaazzz-prog.fr>
      - APP_WEB_URL=https://faildaily.com
      # Configuration Firebase Cloud Messaging (Push Notifications)
      - FCM_SERVICE_ACCOUNT_FILE=${FCM_SERVICE_ACCOUNT_FILE}
      - FCM_PROJECT_ID=${FCM_PROJECT_ID}
    networks:
      - faildaily-ssl-network
    volumes:
      - faildaily_backend-uploads-ssl:/app/uploads
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.backend.rule=Host(`faildaily.com`) && PathPrefix(`/api/`)"
      - "traefik.http.routers.backend.priority=100"
      - "traefik.http.routers.backend.tls=true"
      - "traefik.http.routers.backend.tls.certresolver=letsencrypt"
      - "traefik.http.services.backend.loadbalancer.server.port=3000"
      # ============================================
      # MIDDLEWARE SÉCURITÉ
      # ============================================
      - "traefik.http.middlewares.security-headers.headers.framedeny=true"
      - "traefik.http.middlewares.security-headers.headers.contentTypeNosniff=true"
      - "traefik.http.middlewares.security-headers.headers.browserXssFilter=true"
      - "traefik.http.middlewares.security-headers.headers.referrerPolicy=same-origin"
      - "traefik.http.middlewares.security-headers.headers.stsSeconds=31536000"
      - "traefik.http.middlewares.security-headers.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.security-headers.headers.stsPreload=true"
      - "traefik.http.middlewares.security-headers.headers.customRequestHeaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.backend.middlewares=security-headers"

  # Frontend avec SSL
  frontend:
    build:
      context: ./frontend
      dockerfile: ../docker/production/frontend.prod.Dockerfile
    container_name: faildaily-frontend-ssl
    restart: unless-stopped
    networks:
      - faildaily-ssl-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.frontend.rule=Host(`faildaily.com`)"
      - "traefik.http.routers.frontend.priority=50"
      - "traefik.http.routers.frontend.tls=true"
      - "traefik.http.routers.frontend.tls.certresolver=letsencrypt"
      - "traefik.http.services.frontend.loadbalancer.server.port=80"

  # Service PowerPoint pour api.faildaily.com
  powerpoint:
    image: node:20-alpine
    container_name: faildaily-powerpoint-ssl
    restart: unless-stopped
    working_dir: /app
    volumes:
      - ./powerpoint:/app
    networks:
      - faildaily-ssl-network
    command: npx serve -s . -p 3000
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.powerpoint-service.rule=Host(`api.faildaily.com`)"
      - "traefik.http.routers.powerpoint-service.tls=true"
      - "traefik.http.routers.powerpoint-service.tls.certresolver=letsencrypt"
      - "traefik.http.services.powerpoint-service.loadbalancer.server.port=3000"

  # Base de données MySQL
  db:
    image: mysql:8.0.35
    container_name: faildaily-db-ssl
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: "${DB_PASSWORD}"
      MYSQL_DATABASE: faildaily
      MYSQL_USER: faildaily_user
      MYSQL_PASSWORD: "${DB_PASSWORD}"
    volumes:
      - faildaily_mysql-data-ssl:/var/lib/mysql
    networks:
      - faildaily-ssl-network
    command: --default-authentication-plugin=mysql_native_password

  # Base de données MySQL pour les logs
  logs_db:
    image: mysql:8.0.35
    container_name: faildaily-logs-db-ssl
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: "${LOGS_DB_ROOT_PASSWORD}"
      MYSQL_DATABASE: faildaily_logs
      MYSQL_USER: logs_user
      MYSQL_PASSWORD: "${LOGS_DB_PASSWORD}"
    volumes:
      - faildaily_logs-data-ssl:/var/lib/mysql
      - ./docker/init-logs-database.sql:/docker-entrypoint-initdb.d/init-logs-database.sql:ro
    networks:
      - faildaily-ssl-network
    command: --default-authentication-plugin=mysql_native_password

networks:
  faildaily-ssl-network:
    driver: bridge

volumes:
  faildaily_mysql-data-ssl:
    external: true
  faildaily_logs-data-ssl:
    external: true
  faildaily_backend-uploads-ssl:
    external: true
  faildaily_traefik-ssl-certs:
    external: true
