services:
  postgres:
    image: postgres:16-alpine
    container_name: arsenaliq-postgres
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-arsenal_iq}
      POSTGRES_USER: ${POSTGRES_USER:-arsenal}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-arsenal_dev_password}
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
      - ./backend/database/init.sql:/docker-entrypoint-initdb.d/01-init.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-arsenal} -d ${POSTGRES_DB:-arsenal_iq}"]
      interval: 10s
      timeout: 5s
      retries: 10
    networks:
      - arsenal_iq

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: arsenaliq-backend
    environment:
      PORT: 5000
      NODE_ENV: ${NODE_ENV:-production}
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_DB: ${POSTGRES_DB:-arsenal_iq}
      POSTGRES_USER: ${POSTGRES_USER:-arsenal}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-arsenal_dev_password}
      FRONTEND_URL: ${FRONTEND_URL:-https://arsenal.example.com}
      ALLOW_REGISTRATION: ${ALLOW_REGISTRATION:-true}
      ALLOW_DEMO_ACCOUNT: ${ALLOW_DEMO_ACCOUNT:-false}
      DEMO_ACCOUNT_EMAIL: ${DEMO_ACCOUNT_EMAIL:-demo@arsenaliq.local}
      DEMO_ACCOUNT_PASSWORD: ${DEMO_ACCOUNT_PASSWORD:-demo1234}
      DEMO_ACCOUNT_NAME: ${DEMO_ACCOUNT_NAME:-Demo User}
    depends_on:
      postgres:
        condition: service_healthy
    labels:
      - traefik.enable=true
      - traefik.docker.network=${TRAEFIK_NETWORK:-traefik}
      - traefik.http.routers.arsenaliq-api.rule=Host(`${TRAEFIK_API_HOST:-api.arsenal.local}`)
      - traefik.http.routers.arsenaliq-api.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
      - traefik.http.routers.arsenaliq-api.tls=true
      - traefik.http.services.arsenaliq-api.loadbalancer.server.port=5000
    networks:
      - arsenal_iq
      - traefik

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        VITE_API_BASE_URL: ${VITE_API_BASE_URL:-https://api.arsenal.example.com/api}
        VITE_ALLOW_REGISTRATION: ${ALLOW_REGISTRATION:-true}
        VITE_ALLOW_DEMO_ACCOUNT: ${ALLOW_DEMO_ACCOUNT:-false}
    container_name: arsenaliq-frontend
    environment:
      CSP_CONNECT_SRC: ${FRONTEND_CSP_CONNECT_SRC:-https://api.arsenal.example.com}
    depends_on:
      - backend
    labels:
      - traefik.enable=true
      - traefik.docker.network=${TRAEFIK_NETWORK:-traefik}
      - traefik.http.routers.arsenaliq-web.rule=Host(`${TRAEFIK_WEB_HOST:-arsenal.local}`)
      - traefik.http.routers.arsenaliq-web.entrypoints=${TRAEFIK_ENTRYPOINT:-websecure}
      - traefik.http.routers.arsenaliq-web.tls=true
      - traefik.http.services.arsenaliq-web.loadbalancer.server.port=80
    networks:
      - arsenal_iq
      - traefik

networks:
  arsenal_iq:
    driver: bridge
  traefik:
    external: true
    name: ${TRAEFIK_NETWORK:-traefik}