services:
    # =========================================================
    # Backend Go
    # =========================================================
    backend:
        image: xor1234/backend-mln:pre-prod
        container_name: gestion-backend
        restart: unless-stopped
        environment:
            - DB_HOST=${DB_HOST:-postgres}
            - DB_PORT=${DB_PORT:-5432}
            - DB_USER=${DB_USER:-postgres}
            - DB_PASSWORD=${DB_PASSWORD}
            - DB_NAME=${DB_NAME:-gestion_db}
            - DB_SSLMODE=${DB_SSLMODE:-disable}
            - SESSION_SECRET=${SESSION_SECRET}
            - USER_JWT_SECRET=${USER_JWT_SECRET}
            - USER_JWT_SECRET_OLD=${USER_JWT_SECRET_OLD}
            - ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
            - ADMIN_JWT_SECRET_OLD=${ADMIN_JWT_SECRET_OLD}
            - REDIS_HOST=${REDIS_HOST:-redis}
            - REDIS_PORT=${REDIS_PORT:-6379}
            - REDIS_PASSWORD=${REDIS_PASSWORD}
            - TOMTOM_API_KEY=${TOMTOM_API_KEY}
            - TOMTOM_API_KEY_1=${TOMTOM_API_KEY_1}
            - TOMTOM_API_KEY_2=${TOMTOM_API_KEY_2}
            - TOMTOM_API_KEY_3=${TOMTOM_API_KEY_3}
            - API_PORT=${API_PORT:-8080}
            - NOWPAYMENTS_IPN_SECRET=${NOWPAYMENTS_IPN_SECRET}
            - TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
            - TELEGRAM_BOT_USERNAME=${TELEGRAM_BOT_USERNAME}
            - TELEGRAM_WEBHOOK_SECRET=${TELEGRAM_WEBHOOK_SECRET}
            - TELEGRAM_WEBHOOK_URL=${TELEGRAM_WEBHOOK_URL}
            - LBTELEGRAM_URL=http://lbtelegram:8081
            - LBTELEGRAM_BOT1_USERNAME=${LBTELEGRAM_BOT1_USERNAME:-GetRezStealer_bot}
            - LBTELEGRAM_BOT2_USERNAME=${LBTELEGRAM_BOT2_USERNAME:-rezDJDFJSFUltraFast_bot}
            - BACKEND_LINK_SECRET=${BACKEND_LINK_SECRET:-change_me_internal_secret}
        volumes:
            - backend_uploads:/app/uploads
        networks:
            - gestion-network
        depends_on:
            postgres:
                condition: service_healthy
            redis:
                condition: service_healthy

    # =========================================================
    # Frontend Web (React/Vite — servi en HTTP interne)
    # =========================================================
    frontend:
        image: xor1234/frontend-mln:pre-prod
        container_name: gestion-frontend
        restart: unless-stopped
        networks:
            - gestion-network
        depends_on:
            - backend

    waf:
        image: xor1234/backend-mln:waf-pre-prod
        container_name: gestion-waf
        restart: unless-stopped
        environment:
            - DISABLE_MODSEC_ENV_SUBST=true
            - PARANOIA=2
            - ANOMALY_INBOUND=5
            - ANOMALY_OUTBOUND=4
            - MODSEC_AUDIT_LOG=/var/log/modsec/modsec_audit.log
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - backend_uploads:/usr/share/nginx/html/uploads:ro
            - ./certs:/etc/nginx/certs:ro
            - ./backend/nginx.conf:/etc/nginx/conf.d/app.conf:ro
            - ./backend/custom-rules.conf:/etc/nginx/modsec/custom-rules.conf:ro
            - /var/log/waf/nginx:/var/log/nginx
            - /var/log/waf/modsec:/var/log/modsec
        networks:
            - gestion-network
        depends_on:
            - backend
            - frontend

    # =========================================================
    # PostgreSQL
    # =========================================================
    postgres:
        image: postgres:16-alpine
        container_name: gestion-postgres
        restart: unless-stopped
        environment:
            - POSTGRES_USER=${DB_USER:-postgres}
            - POSTGRES_PASSWORD=${DB_PASSWORD}
            - POSTGRES_DB=${DB_NAME:-gestion_db}
            - PGDATA=/var/lib/postgresql/data/pgdata
        volumes:
            - postgres_data:/var/lib/postgresql/data
        networks:
            - gestion-network
        healthcheck:
            test:
                [
                    "CMD-SHELL",
                    "pg_isready -U ${DB_USER:-postgres} -d ${DB_NAME:-gestion_db}",
                ]
            interval: 10s
            timeout: 5s
            retries: 5
            start_period: 10s

    # =========================================================
    # Redis
    # =========================================================
    redis:
        image: redis:7-alpine
        container_name: gestion-redis
        restart: unless-stopped
        command: >
            redis-server
            --requirepass ${REDIS_PASSWORD}
            --appendonly yes
            --appendfsync everysec
            --maxmemory 256mb
            --maxmemory-policy allkeys-lru
        volumes:
            - redis_data:/data
        networks:
            - gestion-network
        healthcheck:
            test:
                [
                    "CMD",
                    "redis-cli",
                    "--no-auth-warning",
                    "-a",
                    "${REDIS_PASSWORD}",
                    "ping",
                ]
            interval: 10s
            timeout: 3s
            retries: 5
            start_period: 10s

    # =========================================================
    # LBTelegram — Gateway Telegram load balancer
    # =========================================================
    lbtelegram:
        image: xor1234/load-balancer-tlg:latest
        container_name: gestion-lbtelegram
        restart: unless-stopped
        env_file: ./.env.lbtelegram
        environment:
            - REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379/0
            - DATABASE_URL=postgres://${DB_USER}:${DB_PASSWORD}@postgres:5432/${DB_NAME}?sslmode=disable
        networks:
            - gestion-network
        depends_on:
            postgres:
                condition: service_healthy
            redis:
                condition: service_healthy
            backend:
                condition: service_started

    clamav:
        deploy:
            resources:
                limits:
                    memory: 1g
                    cpus: 0.5
        image: clamav/clamav:latest
        container_name: gestion-clamav
        restart: unless-stopped
        volumes:
            - backend_uploads:/app/uploads:ro
            - clamav_data:/var/lib/clamav
        networks:
            - gestion-network
        healthcheck:
            test: ["CMD", "clamdcheck.sh"]
            interval: 60s
            timeout: 10s
            retries: 3
            start_period: 120s

    dozzle-agent:
        image: amir20/dozzle:latest
        command: agent
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock:ro
        ports:
            - "7007:7007"
        restart: unless-stopped

networks:
    gestion-network:
        driver: bridge
        internal: false
        driver_opts:
            com.docker.network.bridge.name: gestion-br0

volumes:
    postgres_data:
        driver: local
    redis_data:
        driver: local
    backend_uploads:
        driver: local
    clamav_data:
        driver: local