services:
  postgres:
    image: ghcr.io/insforge/postgres-all:latest
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: ${POSTGRES_DB:-insforge}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-change-this-encryption-key-32chars}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
      interval: 5s
      timeout: 5s
      retries: 5
    security_opt:
      - no-new-privileges:true

  postgrest:
    image: postgrest/postgrest:v12.2.12
    restart: unless-stopped
    environment:
      PGRST_DB_URI: postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-insforge}
      PGRST_OPENAPI_SERVER_PROXY_URI: ${POSTGREST_OPENAPI_SERVER_PROXY_URI:-http://localhost:3000}
      PGRST_DB_SCHEMA: public
      PGRST_DB_ANON_ROLE: anon
      PGRST_JWT_SECRET: ${JWT_SECRET:-change-this-jwt-secret-min-32-characters}
      PGRST_DB_CHANNEL_ENABLED: "true"
      PGRST_DB_CHANNEL: pgrst
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:3000/ > /dev/null 2>&1 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s
    security_opt:
      - no-new-privileges:true

  insforge:
    image: ghcr.io/insforge/insforge-oss:latest
    working_dir: /app
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      postgrest:
        condition: service_started
    environment:
      PORT: "7130"
      PROJECT_ROOT: /app
      API_BASE_URL: ${API_BASE_URL:-http://localhost:7130}
      VITE_API_BASE_URL: ${VITE_API_BASE_URL:-http://localhost:7130}
      JWT_SECRET: ${JWT_SECRET:-change-this-jwt-secret-min-32-characters}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-change-this-encryption-key-32chars}
      ROOT_ADMIN_USERNAME: ${ROOT_ADMIN_USERNAME:-${ADMIN_EMAIL:-admin}}
      ROOT_ADMIN_PASSWORD: ${ROOT_ADMIN_PASSWORD:-${ADMIN_PASSWORD:-changeme123}}
      ADMIN_EMAIL: ${ROOT_ADMIN_USERNAME:-${ADMIN_EMAIL:-admin}}
      ADMIN_PASSWORD: ${ROOT_ADMIN_PASSWORD:-${ADMIN_PASSWORD:-changeme123}}
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DB: ${POSTGRES_DB:-insforge}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      DATABASE_URL: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-insforge}
      POSTGREST_BASE_URL: http://postgrest:3000
      DENO_RUNTIME_URL: http://deno:7133
      LOGS_DIR: /insforge-logs
      STORAGE_DIR: /insforge-storage
      INSFORGE_TELEMETRY_DISABLED: ${INSFORGE_TELEMETRY_DISABLED:-}
      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
      STRIPE_TEST_SECRET_KEY: ${STRIPE_TEST_SECRET_KEY:-}
      STRIPE_LIVE_SECRET_KEY: ${STRIPE_LIVE_SECRET_KEY:-}
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
      DISCORD_CLIENT_ID: ${DISCORD_CLIENT_ID:-}
      DISCORD_CLIENT_SECRET: ${DISCORD_CLIENT_SECRET:-}
      MICROSOFT_CLIENT_ID: ${MICROSOFT_CLIENT_ID:-}
      MICROSOFT_CLIENT_SECRET: ${MICROSOFT_CLIENT_SECRET:-}
      LINKEDIN_CLIENT_ID: ${LINKEDIN_CLIENT_ID:-}
      LINKEDIN_CLIENT_SECRET: ${LINKEDIN_CLIENT_SECRET:-}
      X_CLIENT_ID: ${X_CLIENT_ID:-}
      X_CLIENT_SECRET: ${X_CLIENT_SECRET:-}
      APPLE_CLIENT_ID: ${APPLE_CLIENT_ID:-}
      APPLE_CLIENT_SECRET: ${APPLE_CLIENT_SECRET:-}
    volumes:
      - storage-data:/insforge-storage
      - insforge-logs:/insforge-logs
    security_opt:
      - no-new-privileges:true

  deno:
    image: ghcr.io/insforge/deno-runtime:latest
    working_dir: /app
    restart: unless-stopped
    depends_on:
      - postgres
      - postgrest
    environment:
      PORT: "7133"
      DENO_ENV: production
      DENO_DIR: /deno-dir
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DB: ${POSTGRES_DB:-insforge}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGREST_BASE_URL: http://postgrest:3000
      WORKER_TIMEOUT_MS: ${WORKER_TIMEOUT_MS:-60000}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-change-this-encryption-key-32chars}
      JWT_SECRET: ${JWT_SECRET:-change-this-jwt-secret-min-32-characters}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
      AWS_S3_BUCKET: ${AWS_S3_BUCKET:-}
      AWS_REGION: ${AWS_REGION:-}
      S3_ENDPOINT_URL: ${S3_ENDPOINT_URL:-}
    volumes:
      - deno_cache:/deno-dir
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:7133/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 60s
    security_opt:
      - no-new-privileges:true

volumes:
  postgres-data:
    driver: local
  deno_cache:
    driver: local
  storage-data:
    driver: local
  insforge-logs:
    driver: local