services:
  postgres:
    image: postgres:16-alpine
    container_name: flockpal-postgres
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-flockpal}
      POSTGRES_USER: ${POSTGRES_USER:-flockpal}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD for production}
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-flockpal} -d ${POSTGRES_DB:-flockpal}"]
      interval: 10s
      timeout: 5s
      retries: 10
    restart: unless-stopped

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: flockpal-backend
    environment:
      PORT: 5000
      NODE_ENV: production
      TRUST_PROXY: ${TRUST_PROXY:-1}
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_DB: ${POSTGRES_DB:-flockpal}
      POSTGRES_USER: ${POSTGRES_USER:-flockpal}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD for production}
      FRONTEND_URL: ${FRONTEND_URL:?set FRONTEND_URL for production}
      BACKEND_URL: ${BACKEND_URL:?set BACKEND_URL for production}
      ADMIN_EMAILS: ${ADMIN_EMAILS:-}
      RESCUE_STATUS_NOTIFICATION_EMAIL: ${RESCUE_STATUS_NOTIFICATION_EMAIL:-appadmin@flockpal.app}
      DEFAULT_BIRD_PHOTO_PATH: ${DEFAULT_BIRD_PHOTO_PATH:-/app/assets/yoda.png}
      MILESTONE_REMINDERS_ENABLED: ${MILESTONE_REMINDERS_ENABLED:-true}
      MILESTONE_REMINDER_TIME_ZONE: ${MILESTONE_REMINDER_TIME_ZONE:-America/New_York}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      MICROSOFT_CLIENT_ID: ${MICROSOFT_CLIENT_ID:-}
      MICROSOFT_CLIENT_SECRET: ${MICROSOFT_CLIENT_SECRET:-}
      APPLE_CLIENT_ID: ${APPLE_CLIENT_ID:-}
      APPLE_CLIENT_SECRET: ${APPLE_CLIENT_SECRET:-}
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
      STRIPE_PRICE_HOUSEHOLD_CONURE: ${STRIPE_PRICE_HOUSEHOLD_CONURE:-}
      STRIPE_PRICE_HOUSEHOLD_CONURE_MONTHLY: ${STRIPE_PRICE_HOUSEHOLD_CONURE_MONTHLY:-}
      STRIPE_PRICE_HOUSEHOLD_CONURE_YEARLY: ${STRIPE_PRICE_HOUSEHOLD_CONURE_YEARLY:-}
      STRIPE_PRICE_HOUSEHOLD_INDIANRINGNECK: ${STRIPE_PRICE_HOUSEHOLD_INDIANRINGNECK:-}
      STRIPE_PRICE_HOUSEHOLD_INDIANRINGNECK_MONTHLY: ${STRIPE_PRICE_HOUSEHOLD_INDIANRINGNECK_MONTHLY:-}
      STRIPE_PRICE_HOUSEHOLD_INDIANRINGNECK_YEARLY: ${STRIPE_PRICE_HOUSEHOLD_INDIANRINGNECK_YEARLY:-}
      STRIPE_PRICE_HOUSEHOLD_MACAW: ${STRIPE_PRICE_HOUSEHOLD_MACAW:-}
      STRIPE_PRICE_HOUSEHOLD_MACAW_MONTHLY: ${STRIPE_PRICE_HOUSEHOLD_MACAW_MONTHLY:-}
      STRIPE_PRICE_HOUSEHOLD_MACAW_YEARLY: ${STRIPE_PRICE_HOUSEHOLD_MACAW_YEARLY:-}
      STRIPE_CHECKOUT_SUCCESS_URL: ${STRIPE_CHECKOUT_SUCCESS_URL:-${FRONTEND_URL}/?billing=success}
      STRIPE_CHECKOUT_CANCEL_URL: ${STRIPE_CHECKOUT_CANCEL_URL:-${FRONTEND_URL}/?billing=cancelled}
      STRIPE_PORTAL_RETURN_URL: ${STRIPE_PORTAL_RETURN_URL:-${FRONTEND_URL}/}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_SECURE: ${SMTP_SECURE:-false}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASS: ${SMTP_PASS:-}
      SMTP_FROM_EMAIL: ${SMTP_FROM_EMAIL:-}
      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-FlockPal}
    depends_on:
      postgres:
        condition: service_healthy
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik
      - traefik.http.routers.flockpal-api.rule=Host(`${URL:?set URL for production}`) && PathPrefix(`/api`)
      - traefik.http.routers.flockpal-api.entrypoints=websecure
      - traefik.http.routers.flockpal-api.tls.certresolver=${TRAEFIK_CERTRESOLVER:-letsencrypt}
      - traefik.http.routers.flockpal-api.priority=100
      - traefik.http.routers.flockpal-api.middlewares=flockpal-hsts@docker
      - traefik.http.services.flockpal-api.loadbalancer.server.port=5000
    networks:
      - default
      - traefik
    restart: unless-stopped

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        VITE_API_BASE_URL: ${VITE_API_BASE_URL:-/api}
    container_name: flockpal-frontend
    depends_on:
      - backend
    labels:
      - traefik.enable=true
      - traefik.docker.network=traefik
      - traefik.http.routers.flockpal-web.rule=Host(`${URL:?set URL for production}`)
      - traefik.http.routers.flockpal-web.entrypoints=websecure
      - traefik.http.routers.flockpal-web.tls.certresolver=${TRAEFIK_CERTRESOLVER:-letsencrypt}
      - traefik.http.routers.flockpal-web.priority=10
      - traefik.http.routers.flockpal-web.middlewares=flockpal-hsts@docker
      - traefik.http.middlewares.flockpal-hsts.headers.stsSeconds=31536000
      - traefik.http.middlewares.flockpal-hsts.headers.stsIncludeSubdomains=true
      - traefik.http.middlewares.flockpal-hsts.headers.stsPreload=false
      - traefik.http.middlewares.flockpal-hsts.headers.forceSTSHeader=true
      - traefik.http.services.flockpal-web.loadbalancer.server.port=80
    networks:
      - traefik
    restart: unless-stopped

networks:
  traefik:
    external: true