services:
  postgres:
    image: postgres:15-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-privexa}
      POSTGRES_USER: ${POSTGRES_USER:-privexa}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-privexa}
    ports:
      - "${POSTGRES_PORT:-5433}:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-privexa} -d ${POSTGRES_DB:-privexa}"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    command: ["redis-server", "--save", "", "--appendonly", "no"]
    restart: unless-stopped
    ports:
      - "${REDIS_PORT:-6379}:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  backend:
    build:
      context: .
      dockerfile: Dockerfile.backend
    restart: unless-stopped
    environment:
      NODE_ENV: production
      PORT: 3000
      DATABASE_URL: ${DATABASE_URL:-postgres://privexa:privexa@postgres:5432/privexa}
      REDIS_URL: ${REDIS_URL:-redis://redis:6379}
      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL:-https://login.microsoftonline.com/8f7f9921-d345-455b-8fb4-ba018c20e84a/v2.0}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-27968c41-b2d9-4df1-8487-7da3be7610e0}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-HzB8Q~zntYnc9qCdWCPNHkg2YL669eeWDaiNscC_}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-http://localhost:8080/oauth/callback}
      OIDC_POST_LOGOUT_REDIRECT_URI: ${OIDC_POST_LOGOUT_REDIRECT_URI:-http://localhost:8080}
      OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email User.Read GroupMember.Read.All Files.Read Mail.Read Sites.Read.All offline_access}
      OIDC_DISABLED: ${OIDC_DISABLED:-false}
      DISABLE_WORKERS: ${DISABLE_WORKERS:-false}
      FRONTEND_BASE_URL: ${FRONTEND_BASE_URL:-http://localhost:8080}
      BACKEND_BASE_URL: ${BACKEND_BASE_URL:-http://localhost:3000}
      INTERNAL_EMAIL_DOMAIN: ${INTERNAL_EMAIL_DOMAIN:-trustedvision.biz}
      AUDIT_HMAC_SECRET: ${AUDIT_HMAC_SECRET:-audit-secret}
      # Local Authentication
      LOCAL_AUTH_ENABLED: ${LOCAL_AUTH_ENABLED:-true}
      LOCAL_JWT_SECRET: ${LOCAL_JWT_SECRET:-change-this-secret-key-in-production-min-32-chars}
      LOCAL_JWT_ISSUER: ${LOCAL_JWT_ISSUER:-trustedvision-local}
      LOCAL_JWT_AUDIENCE: ${LOCAL_JWT_AUDIENCE:-trustedvision-app}
      LOCAL_JWT_TTL_SECONDS: ${LOCAL_JWT_TTL_SECONDS:-3600}
      # Password Policy
      LOCAL_AUTH_PASSWORD_MIN_LENGTH: ${LOCAL_AUTH_PASSWORD_MIN_LENGTH:-8}
      LOCAL_AUTH_PASSWORD_REQUIRE_UPPERCASE: ${LOCAL_AUTH_PASSWORD_REQUIRE_UPPERCASE:-true}
      LOCAL_AUTH_PASSWORD_REQUIRE_LOWERCASE: ${LOCAL_AUTH_PASSWORD_REQUIRE_LOWERCASE:-true}
      LOCAL_AUTH_PASSWORD_REQUIRE_NUMBER: ${LOCAL_AUTH_PASSWORD_REQUIRE_NUMBER:-true}
      LOCAL_AUTH_PASSWORD_REQUIRE_SPECIAL: ${LOCAL_AUTH_PASSWORD_REQUIRE_SPECIAL:-true}
      # Rate Limiting
      LOCAL_AUTH_MAX_LOGIN_ATTEMPTS: ${LOCAL_AUTH_MAX_LOGIN_ATTEMPTS:-5}
      LOCAL_AUTH_LOGIN_WINDOW_SECONDS: ${LOCAL_AUTH_LOGIN_WINDOW_SECONDS:-900}
      # API Base URL
      API_BASE_URL: ${API_BASE_URL:-http://localhost:3000}
      ML_SERVICE_URL: ${ML_SERVICE_URL:-http://ml-service:8000}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      ml-service:
        condition: service_healthy
    ports:
      - "${BACKEND_PORT:-3000}:3000"

  frontend:
    build:
      context: .
      dockerfile: Dockerfile.frontend
      args:
        VITE_API_URL: ${VITE_API_URL:-http://localhost:3000}
        VITE_OIDC_CLIENT_ID: ${VITE_OIDC_CLIENT_ID:-}
        VITE_INTERNAL_EMAIL_DOMAIN: ${VITE_INTERNAL_EMAIL_DOMAIN:-trustedvision.biz}
    restart: unless-stopped
    depends_on:
      backend:
        condition: service_started
    ports:
      - "${FRONTEND_PORT:-8080}:80"

  ml-service:
    build:
      context: ./ml-service
      dockerfile: Dockerfile
    restart: unless-stopped
    environment:
      - ML_MODELS_PATH=/app/models
      - TORCH_HOME=/app/.cache/torch
      - TRANSFORMERS_CACHE=/app/.cache/transformers
      - PYTHONUNBUFFERED=1
    volumes:
      - ml-models:/app/models
      - ml-cache:/app/.cache
    ports:
      - "${ML_SERVICE_PORT:-8000}:8000"
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

volumes:
  postgres-data:
  ml-models:
  ml-cache:

