services:
  db:
    image: postgres:15-alpine
    pull_policy: if_not_present
    container_name: ctms_db
    restart: always
    environment:
      POSTGRES_USER: ctms_user
      POSTGRES_PASSWORD: secret_password
      POSTGRES_DB: ctms_db
    volumes:
      # 持久化数据到 Linux 本地，防止重启丢失
      - ./pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ctms_user -d ctms_db"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - ctms_net

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
      pull: false
    container_name: ctms_backend
    restart: always
    environment:
      DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
      ENV: ${ENV:-development}
      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-dev-secret}
      LOGIN_RSA_PRIVATE_KEY: ${LOGIN_RSA_PRIVATE_KEY:-}
      LOGIN_RSA_KEY_ID: ${LOGIN_RSA_KEY_ID:-default}
    depends_on:
      db:
        condition: service_healthy
    networks:
      - ctms_net

  backend-init:
    build:
      context: ./backend
      dockerfile: Dockerfile
      pull: false
    command: python scripts/init_production.py
    environment:
      DATABASE_URL: postgresql+asyncpg://ctms_user:secret_password@db/ctms_db
      ENV: ${ENV:-development}
      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-dev-secret}
      LOGIN_RSA_PRIVATE_KEY: ${LOGIN_RSA_PRIVATE_KEY:-}
      LOGIN_RSA_KEY_ID: ${LOGIN_RSA_KEY_ID:-default}
    depends_on:
      db:
        condition: service_healthy
    profiles: ["init"]
    networks:
      - ctms_net

  nginx:
    build:
      context: .
      dockerfile: nginx/Dockerfile
      pull: false
      args:
        NPM_CONFIG_REGISTRY: ${NPM_CONFIG_REGISTRY:-https://registry.npmmirror.com}
        VITE_RUNTIME_ENV: ${ENV:-production}
        VITE_ALLOW_INSECURE_DEV_LOGIN: ${VITE_ALLOW_INSECURE_DEV_LOGIN:-false}
    container_name: ctms_nginx
    restart: always
    ports:
      - "8888:80"
    volumes:
      - ./nginx/certs:/etc/nginx/certs:ro
      - ./frontend/public/favicon.ico:/usr/share/nginx/html/favicon.ico:ro
    depends_on:
      - backend
    networks:
      - ctms_net

networks:
  ctms_net:
    driver: bridge