services:
  postgres:
    image: postgres:16-alpine
    container_name: scanreceipts_postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-receipt_user}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-receipt_secure_password}
      POSTGRES_DB: ${POSTGRES_DB:-receipt_scanner}
    ports:
      # Host port 5436 by default: 5432 is commonly taken by another project's
      # database on a dev machine, and binding it would fail the whole stack.
      # The container still listens on 5432 internally, so the `app` service's
      # DATABASE_URL (postgres:5432) is unaffected.
      - "${POSTGRES_PORT:-5436}:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      # Database least privilege: provision the runtime role `receipt_app` on a
      # FRESH volume. Initdb scripts run as POSTGRES_USER (superuser), which is
      # exactly the rights needed to create the role and set default privileges.
      # They only run once, at first volume creation — an already-initialized
      # database (like the local dev DB) must be set up with
      # `node scripts/apply-db-permissions.mjs` instead.
      - ./scripts/db-permissions.sql:/docker-entrypoint-initdb.d/10-db-permissions.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-receipt_user} -d ${POSTGRES_DB:-receipt_scanner}"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - scanreceipts_network

  app:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
        NEXT_PUBLIC_UMAMI_SRC: ${NEXT_PUBLIC_UMAMI_SRC:-}
        NEXT_PUBLIC_UMAMI_ID: ${NEXT_PUBLIC_UMAMI_ID:-}
    container_name: scanreceipts_app
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - "3000:3000"
    volumes:
      # Grants the admin dashboard's "Docker Logs" page (/admin/logs) access
      # to `docker logs -f`. SECURITY: mounting the Docker socket gives this
      # container root-equivalent control of the host — anyone who can
      # execute code inside the app container (e.g. via an app vulnerability)
      # can use it to control every container and, from there, the host
      # itself. The API route is admin-gated (getAdminUser), but that only
      # protects the intended entry point, not this blast radius. Remove this
      # mount (and docker-entrypoint-logs.sh / the docker-cli + su-exec
      # packages in the Dockerfile) if that trade-off isn't acceptable for
      # your deployment.
      # Not :ro — docker-entrypoint-logs.sh chmods the socket at container
      # startup (see that script for why a plain group-permission fix isn't
      # reliable here), which needs the mount to be writable.
      - /var/run/docker.sock:/var/run/docker.sock
    healthcheck:
      # 127.0.0.1, not localhost: Alpine's musl resolver returns ::1 first for
      # "localhost", but the Next.js standalone server (HOSTNAME=0.0.0.0 in the
      # Dockerfile) only binds IPv4 — wget to "localhost" gets connection
      # refused on ::1 even while the app is completely healthy on IPv4.
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/api/auth/providers"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    environment:
      - NODE_ENV=production
      # Container-internal address: the host port mapping above is irrelevant in
      # here, services reach each other by service name on the compose network.
      - DATABASE_URL=postgresql://${POSTGRES_USER:-receipt_user}:${POSTGRES_PASSWORD:-receipt_secure_password}@postgres:5432/${POSTGRES_DB:-receipt_scanner}
      # Least-privilege runtime connection (optional): points at the restricted
      # `receipt_app` role created by scripts/db-permissions.sql. The app
      # binary reads DATABASE_URL above, so in production run the runtime with
      # this URL and keep DATABASE_URL (the owner) for migrations/schema init.
      - APP_DATABASE_URL=postgresql://receipt_app:${APP_DATABASE_PASSWORD:-receipt_app_secure_password}@postgres:5432/${POSTGRES_DB:-receipt_scanner}
      - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
      # Scopes session/CSRF/guest/OAuth cookies to the parent domain so
      # app.<domain> and admin.<domain> share the same login as the bare
      # domain (see src/lib/auth/config.ts). Leave unset for host-only
      # cookies (single-domain / local development).
      - COOKIE_DOMAIN=${COOKIE_DOMAIN:-}
      - NEXT_PUBLIC_UMAMI_SRC=${NEXT_PUBLIC_UMAMI_SRC:-}
      - NEXT_PUBLIC_UMAMI_ID=${NEXT_PUBLIC_UMAMI_ID:-}
      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
      - OPENROUTER_MODEL=${OPENROUTER_MODEL:-openai/gpt-5.6-luna}
      # Vision fallbacks — scanning still works on OpenRouter alone, but without
      # these the fallback chain has nowhere to go.
      - GEMINI_API_KEY=${GEMINI_API_KEY}
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY}
      - DEEPSEEK_BASE_URL=${DEEPSEEK_BASE_URL}
      - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY}
      - STRIPE_PUBLISHABLE_KEY=${STRIPE_PUBLISHABLE_KEY}
      - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET}
      - STRIPE_WEEKLY_PRICE_ID=${STRIPE_WEEKLY_PRICE_ID}
      - STRIPE_ANNUAL_PRICE_ID=${STRIPE_ANNUAL_PRICE_ID}
      - STRIPE_LIFETIME_PRICE_ID=${STRIPE_LIFETIME_PRICE_ID}
      - DISCORD_SALES_WEBHOOK_URL=${DISCORD_SALES_WEBHOOK_URL}
      # Auth: without these the Google button never renders and signup fails
      # with mail_failed, because NODE_ENV=production refuses the dev fallback.
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_USER=${SMTP_USER}
      - SMTP_PASSWORD=${SMTP_PASSWORD}
      - SMTP_SECURE=${SMTP_SECURE:-false}
      - MAIL_FROM=${MAIL_FROM:-ScanReceipts <no-reply@localhost>}
      - ADMIN_EMAILS=${ADMIN_EMAILS:-}
      # CORS allowlist: comma-separated extra origins allowed to call the API.
      # The app's own origin (NEXT_PUBLIC_APP_URL) is always allowed.
      - CORS_ORIGINS=${CORS_ORIGINS:-}
    networks:
      - scanreceipts_network

volumes:
  postgres_data:
    driver: local

networks:
  scanreceipts_network:
    driver: bridge