# Referenz-Stack: MariaDB + TerraFlow (Apache/PHP) + Traefik (TLS, Let's Encrypt)
# Ausführung aus dem Verzeichnis deploy/: docker compose --env-file .env up -d
# Build-Kontext ist das Projektroot (ein Verzeichnis über dieser Datei).

services:
  database:
    image: mariadb:10.11
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:?set MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: ${MYSQL_DATABASE:-terraflow}
      MYSQL_USER: ${MYSQL_USER:-terraflow}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:?set MYSQL_PASSWORD}
    volumes:
      - mysql_data:/var/lib/mysql
    healthcheck:
      test: ['CMD', 'healthcheck.sh', '--connect', '--innodb_initialized']
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s

  app:
    build:
      context: ..
      dockerfile: deploy/Dockerfile
    restart: unless-stopped
    depends_on:
      database:
        condition: service_healthy
    environment:
      APP_ENV: prod
      APP_DEBUG: '0'
      APP_SECRET: ${APP_SECRET:?set APP_SECRET}
      DATABASE_URL: ${DATABASE_URL}
      MAILER_DSN: ${MAILER_DSN:-null://null}
      TERRAFLOW_BOOTSTRAP_ADMIN_USERNAME: ${TERRAFLOW_BOOTSTRAP_ADMIN_USERNAME:-admin}
      TERRAFLOW_BOOTSTRAP_ADMIN_EMAIL: ${TERRAFLOW_BOOTSTRAP_ADMIN_EMAIL:-}
      TERRAFLOW_BOOTSTRAP_ADMIN_PASSWORD: ${TERRAFLOW_BOOTSTRAP_ADMIN_PASSWORD:-}
    volumes:
      # Gesamtes var/ inkl. Cache/Sessions — OAuth2-Keys müssen IM Container (oder in diesem Volume) liegen:
      #   docker compose exec app bash -lc 'mkdir -p var/oauth2 && openssl genrsa -out var/oauth2/private.key 2048 && openssl rsa -in var/oauth2/private.key -pubout -out var/oauth2/public.key && chown -R www-data:www-data var/oauth2 && chmod 600 var/oauth2/private.key'
      # Nur auf dem Host im Git-Checkout ausführen reicht nicht, solange hier ein Docker-Volume gemountet ist.
      - terraflow_var:/var/www/html/var
      - terraflow_uploads:/var/www/html/public/uploads
    labels:
      - traefik.enable=true
      - traefik.http.routers.terraflow.rule=Host(`${TRAEFIK_HOST:?set TRAEFIK_HOST}`)
      - traefik.http.routers.terraflow.entrypoints=websecure
      - traefik.http.routers.terraflow.tls.certresolver=le
      - traefik.http.routers.terraflow.service=terraflow
      - traefik.http.services.terraflow.loadbalancer.server.port=80

  traefik:
    image: traefik:v2.11
    restart: unless-stopped
    command:
      - --api.dashboard=false
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --certificatesresolvers.le.acme.tlschallenge=true
      - --certificatesresolvers.le.acme.email=${ACME_EMAIL:?set ACME_EMAIL for Let's Encrypt}
      - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
    ports:
      - '80:80'
      - '443:443'
    volumes:
      - ./traefik/acme.json:/letsencrypt/acme.json
      - /var/run/docker.sock:/var/run/docker.sock:ro

volumes:
  mysql_data:
  terraflow_var:
  terraflow_uploads:
