services:
  # ============================================================
  # TRAEFIK - REVERSE PROXY SSL (identique OVH)
  # ============================================================
  traefik:
    image: traefik:v2.10
    container_name: web-sentinel-traefik-local
    restart: unless-stopped
    command:
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=faildaily_faildaily-ssl-network"
      - "--certificatesresolvers.letsencrypt.acme.email=bruno@taaazzz.be"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--entrypoints.websecure.http.middlewares=security-headers@docker"
    ports:
      - "80:80"
      - "443:443"
      - "8090:8080"  # Dashboard Traefik sur 8090 localement
    volumes:
      - //var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certs:/letsencrypt
    networks:
      - faildaily-ssl-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.security-headers.headers.sslredirect=true"
      - "traefik.http.middlewares.security-headers.headers.stsSeconds=31536000"
      - "traefik.http.middlewares.security-headers.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.security-headers.headers.stsPreload=true"
      - "traefik.http.middlewares.security-headers.headers.forceSTSHeader=true"

  # API Web Sentinel
  web-sentinel-api:
    build:
      context: ../..
      dockerfile: deployment/Dockerfile.api.stripe
    container_name: web-sentinel-api
    restart: unless-stopped
    expose:
      - "5000"
    volumes:
      - api_data:/app/data
      - license_data:/root/.web-sentinel
    environment:
      - DATABASE_URL=postgresql://websentinel_user:${POSTGRES_PASSWORD}@web-sentinel-db:5432/websentinel_prod
      - WEB_SENTINEL_POSTGRES_URL=${DATABASE_URL}
      - WEB_SENTINEL_LICENSE_BACKEND=postgresql
      - REDIS_URL=redis://web-sentinel-redis:6379/0
      - WEB_SENTINEL_SECRET_KEY=${WEB_SENTINEL_SECRET_KEY}
      - FLASK_ENV=production
      # Variables Stripe (optionnelles)
      - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY:-}
      - STRIPE_PUBLISHABLE_KEY=${STRIPE_PUBLISHABLE_KEY:-}
      - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET:-}
      - BASE_URL=https://web-sentinel.taaazzz-prog.fr
      # SMTP (optionnel)
      - SMTP_HOST=${SMTP_HOST:-localhost}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_USER=${SMTP_USER:-}
      - SMTP_PASSWORD=${SMTP_PASSWORD:-}
      - FROM_EMAIL=${FROM_EMAIL:-noreply@web-sentinel.taaazzz-prog.fr}
      - FROM_NAME=${FROM_NAME:-Web Sentinel}
    networks:
      - faildaily-ssl-network
    depends_on:
      - web-sentinel-db
      - web-sentinel-redis
      - web-sentinel-smtp
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.web-sentinel-api.rule=Host(`api.web-sentinel.taaazzz-prog.fr`)"
      - "traefik.http.routers.web-sentinel-api.tls=true"
      - "traefik.http.routers.web-sentinel-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.web-sentinel-api.loadbalancer.server.port=5000"

  # Base de données PostgreSQL
  web-sentinel-db:
    image: postgres:15-alpine
    container_name: web-sentinel-db
    restart: unless-stopped
    environment:
      - POSTGRES_USER=websentinel_user
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=websentinel_prod
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - faildaily-ssl-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U websentinel_user -d websentinel_prod"]
      interval: 10s
      timeout: 5s
      retries: 3

  # Cache Redis
  web-sentinel-redis:
    image: redis:7-alpine
    container_name: web-sentinel-redis
    restart: unless-stopped
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    networks:
      - faildaily-ssl-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3

  # Serveur SMTP
  web-sentinel-smtp:
    image: namshi/smtp:latest
    container_name: web-sentinel-smtp
    restart: unless-stopped
    networks:
      - faildaily-ssl-network

  # Documentation
  web-sentinel-docs:
    image: nginx:alpine
    container_name: web-sentinel-docs
    restart: unless-stopped
    volumes:
      - ../../docs:/usr/share/nginx/html
      - ../nginx/nginx-docs.conf:/etc/nginx/conf.d/default.conf
    networks:
      - faildaily-ssl-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.web-sentinel-docs.rule=Host(`docs.web-sentinel.taaazzz-prog.fr`)"
      - "traefik.http.routers.web-sentinel-docs.tls=true"
      - "traefik.http.routers.web-sentinel-docs.tls.certresolver=letsencrypt"

  # Installation
  web-sentinel-install:
    image: nginx:alpine
    container_name: web-sentinel-install
    restart: unless-stopped
    volumes:
      - ../../install:/usr/share/nginx/html
      - ../nginx/nginx-install.conf:/etc/nginx/conf.d/default.conf
    networks:
      - faildaily-ssl-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.web-sentinel-install.rule=Host(`install.web-sentinel.taaazzz-prog.fr`)"
      - "traefik.http.routers.web-sentinel-install.tls=true"
      - "traefik.http.routers.web-sentinel-install.tls.certresolver=letsencrypt"

  # Interface Web
  web-sentinel-web:
    image: nginx:alpine
    container_name: web-sentinel-web
    restart: unless-stopped
    volumes:
      - ../../web:/usr/share/nginx/html
      - ../nginx/nginx-web.conf:/etc/nginx/conf.d/default.conf
    networks:
      - faildaily-ssl-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.web-sentinel-web.rule=Host(`web-sentinel.taaazzz-prog.fr`)"
      - "traefik.http.routers.web-sentinel-web.tls=true"
      - "traefik.http.routers.web-sentinel-web.tls.certresolver=letsencrypt"

  # Statistiques
  web-sentinel-stats:
    image: nginx:alpine
    container_name: web-sentinel-stats
    restart: unless-stopped
    volumes:
      - ../../web/stats:/usr/share/nginx/html
      - ../nginx/nginx-stats.conf:/etc/nginx/conf.d/default.conf
    networks:
      - faildaily-ssl-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.web-sentinel-stats.rule=Host(`stats.web-sentinel.taaazzz-prog.fr`)"
      - "traefik.http.routers.web-sentinel-stats.tls=true"
      - "traefik.http.routers.web-sentinel-stats.tls.certresolver=letsencrypt"

volumes:
  postgres_data:
  redis_data:
  api_data:
  license_data:
  traefik-certs:

networks:
  faildaily-ssl-network:
    external: true
    name: faildaily_faildaily-ssl-network

