# ─── IliaCloud — Docker Compose ───────────────────────────────────────────────
# Services : PostgreSQL 16 + Backend Node.js
# Réseau : iliacloud_net (interne) + traefik_net (ingress externe)

version: "3.8"

services:
  # ─── PostgreSQL ───────────────────────────────────────────────────────────
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: iliacloud
      POSTGRES_USER: iliacloud
      # IMPORTANT : changer en production avec une valeur forte
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD est requis}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - iliacloud_net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U iliacloud"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ─── Backend Node.js ──────────────────────────────────────────────────────
  backend:
    build: .
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      gotenberg:
        condition: service_started
    environment:
      NODE_ENV: production
      PORT: 3000
      DATABASE_URL: postgresql://iliacloud:${POSTGRES_PASSWORD}@postgres:5432/iliacloud
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET est requis}
      JWT_EXPIRES_IN: 15m
      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:?JWT_REFRESH_SECRET est requis}
      JWT_REFRESH_EXPIRES_IN: 7d
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:?ENCRYPTION_KEY est requis}
      CORS_ORIGIN: ${CORS_ORIGIN:-https://iliacloud.votre-domaine.com}
      GOTENBERG_URL: http://gotenberg:3000
      RATE_LIMIT_WINDOW_MS: 900000
      RATE_LIMIT_MAX: 100
    networks:
      - iliacloud_net
      - traefik_net
    # Healthcheck : vérifier que le backend répond sur /health
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/health', (r) => { process.exit(r.statusCode === 200 ? 0 : 1) })"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.iliacloud-api.rule=Host(`api.iliacloud.votre-domaine.com`)"
      - "traefik.http.routers.iliacloud-api.entrypoints=websecure"
      - "traefik.http.routers.iliacloud-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.iliacloud-api.loadbalancer.server.port=3000"
      # WebSocket support
      - "traefik.http.middlewares.iliacloud-ws.headers.customrequestheaders.Connection=Upgrade"
      - "traefik.http.middlewares.iliacloud-ws.headers.customrequestheaders.Upgrade=websocket"

  # ─── Gotenberg — Conversion HTML → PDF ────────────────────────────────────
  gotenberg:
    image: gotenberg/gotenberg:8
    restart: unless-stopped
    networks:
      - iliacloud_net
    # Securite : desactiver les endpoints inutiles
    command:
      - "gotenberg"
      - "--api-timeout=30s"
      - "--chromium-disable-javascript=true"

volumes:
  postgres_data:

networks:
  iliacloud_net:
    driver: bridge
  traefik_net:
    external: true
    name: traefik_net
