name: mpm

services:
  postgres:
    image: postgres:18-alpine
    container_name: mpm-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:?Bitte POSTGRES_USER in .env setzen}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Bitte POSTGRES_PASSWORD in .env setzen}
      POSTGRES_DB: ${POSTGRES_DB:?Bitte POSTGRES_DB in .env setzen}
    # Nur für lokale Entwicklung auf dem Host erreichbar (Loopback).
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      # postgres:18+ empfiehlt den Mount auf /var/lib/postgresql
      # (Daten liegen dann im Unterverzeichnis), siehe docker-library/postgres#37
      - postgres-data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  platform:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: mpm-platform
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      NODE_ENV: ${NODE_ENV:-production}
      PORT: ${PORT:-3000}
      DATABASE_URL: ${DATABASE_URL:?Bitte DATABASE_URL in .env setzen}
      SESSION_TTL_MINUTES: ${SESSION_TTL_MINUTES:-120}
      COOKIE_SECURE: ${COOKIE_SECURE:-true}
      BEHIND_PROXY: "true"
      MODULE_UID_BASE: ${MODULE_UID_BASE:-20000}
      MODULE_DOCKER_HOST: unix:///var/run/docker.sock
      MPM_CONTAINER_NAME: mpm-platform
      DOCKER_SOCKET_GID: ${DOCKER_SOCKET_GID:-0}
      MODULES_DIR: /app/data/modules
      LOGS_DIR: /app/data/logs
      ADMIN_USERNAME: ${ADMIN_USERNAME:?Bitte ADMIN_USERNAME in .env setzen}
      ADMIN_EMAIL: ${ADMIN_EMAIL:?Bitte ADMIN_EMAIL in .env setzen}
      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?Bitte ADMIN_PASSWORD in .env setzen}
      MARKETPLACE_PUBLIC_URL: ${MARKETPLACE_PUBLIC_URL:-http://127.0.0.1:${APP_PORT:-8080}}
      MARKETPLACE_TOKEN_ENCRYPTION_KEY: ${MARKETPLACE_TOKEN_ENCRYPTION_KEY:-}
      GITHUB_OAUTH_CLIENT_ID: ${GITHUB_OAUTH_CLIENT_ID:-}
      GITHUB_OAUTH_CLIENT_SECRET: ${GITHUB_OAUTH_CLIENT_SECRET:-}
      GITEA_BASE_URL: ${GITEA_BASE_URL:-}
      GITEA_OAUTH_CLIENT_ID: ${GITEA_OAUTH_CLIENT_ID:-}
      GITEA_OAUTH_CLIENT_SECRET: ${GITEA_OAUTH_CLIENT_SECRET:-}
      FORGEJO_BASE_URL: ${FORGEJO_BASE_URL:-}
      FORGEJO_OAUTH_CLIENT_ID: ${FORGEJO_OAUTH_CLIENT_ID:-}
      FORGEJO_OAUTH_CLIENT_SECRET: ${FORGEJO_OAUTH_CLIENT_SECRET:-}
    ports:
      - "127.0.0.1:${APP_PORT:-8080}:8080"
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - KILL
    security_opt:
      - no-new-privileges:true
    group_add:
      - "${DOCKER_SOCKET_GID:-0}"
    volumes:
      # Needed by the backend to manage isolated per-module Compose stacks.
      # Module containers never receive this socket.
      - /var/run/docker.sock:/var/run/docker.sock
      # Modul-Installationen und Logs persistent halten (Container-Updates überleben)
      - modules-data:/app/data/modules
      - module-logs:/app/data/logs

volumes:
  postgres-data:
  modules-data:
  module-logs: