services:
    # =========================================================
    # Backend Go
    # =========================================================
    backend:
        build:
            context: ..
            dockerfile: docker/backend/Dockerfile
            target: runtime
        container_name: gestion-backend
        restart: unless-stopped
        environment:
            - DB_HOST=${DB_HOST:-postgres}
            - DB_PORT=${DB_PORT:-5432}
            - DB_USER=${DB_USER:-postgres}
            - DB_PASSWORD=${DB_PASSWORD}
            - DB_NAME=${DB_NAME:-gestion_db}
            - DB_SSLMODE=${DB_SSLMODE:-disable}
            - SESSION_SECRET=${SESSION_SECRET}
            - USER_JWT_SECRET=${USER_JWT_SECRET}
            - USER_JWT_SECRET_OLD=${USER_JWT_SECRET_OLD}
            - ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
            - ADMIN_JWT_SECRET_OLD=${ADMIN_JWT_SECRET_OLD}
            - REDIS_HOST=${REDIS_HOST:-redis}
            - REDIS_PORT=${REDIS_PORT:-6379}
            - REDIS_PASSWORD=${REDIS_PASSWORD}
            - TOMTOM_API_KEY=${TOMTOM_API_KEY}
            - API_PORT=${API_PORT:-8080}
        volumes:
            - backend_uploads:/app/uploads
        networks:
            - gestion-network
        depends_on:
            postgres:
                condition: service_healthy
            redis:
                condition: service_healthy

    # =========================================================
    # WAF (Nginx + ModSecurity)
    # =========================================================
    waf:
        build:
            context: ..
            dockerfile: docker/backend/Dockerfile
            target: waf
        container_name: gestion-waf
        restart: unless-stopped
        environment:
            - DISABLE_MODSEC_ENV_SUBST=true
            - PARANOIA=2
            - ANOMALY_INBOUND=5
            - ANOMALY_OUTBOUND=4
        ports:
            - "80:80"
            - "443:443"
        volumes:
            - backend_uploads:/usr/share/nginx/html/uploads:ro
        networks:
            - gestion-network
        depends_on:
            - backend

    # =========================================================
    # PostgreSQL
    # =========================================================
    postgres:
        image: postgres:16-alpine
        container_name: gestion-postgres
        restart: unless-stopped
        environment:
            - POSTGRES_USER=${DB_USER:-postgres}
            - POSTGRES_PASSWORD=${DB_PASSWORD}
            - POSTGRES_DB=${DB_NAME:-gestion_db}
            - PGDATA=/var/lib/postgresql/data/pgdata
        volumes:
            - postgres_data:/var/lib/postgresql/data
        networks:
            - gestion-network
        healthcheck:
            test:
                [
                    "CMD-SHELL",
                    "pg_isready -U ${DB_USER:-postgres} -d ${DB_NAME:-gestion_db}",
                ]
            interval: 10s
            timeout: 5s
            retries: 5
            start_period: 10s

    # =========================================================
    # Redis
    # =========================================================
    redis:
        image: redis:7-alpine
        container_name: gestion-redis
        restart: unless-stopped
        command: >
            redis-server
            --requirepass ${REDIS_PASSWORD}
            --appendonly yes
            --appendfsync everysec
            --maxmemory 256mb
            --maxmemory-policy allkeys-lru
        volumes:
            - redis_data:/data
        networks:
            - gestion-network
        healthcheck:
            test:
                [
                    "CMD",
                    "redis-cli",
                    "--no-auth-warning",
                    "-a",
                    "${REDIS_PASSWORD}",
                    "ping",
                ]
            interval: 10s
            timeout: 3s
            retries: 5
            start_period: 10s

networks:
    gestion-network:
        driver: bridge
        internal: false
        driver_opts:
            com.docker.network.bridge.name: gestion-br0

volumes:
    postgres_data:
        driver: local
    redis_data:
        driver: local
    backend_uploads:
        driver: local