services:
  backend:
    build:
      context: .
      dockerfile: backend/Dockerfile
    env_file:
      - .env
    environment:
      AUTH_ENABLED: "true"
      SSH_KEY_FILENAME: /root/.ssh/${SSH_KEY_NAME}
    volumes:
      - ./secrets/ssh:/root/.ssh:ro
    restart: unless-stopped
    expose:
      - "8000"
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import json, urllib.request; print(json.load(urllib.request.urlopen('http://127.0.0.1:8000/api/health'))['status'])",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s

  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
      target: prod
      args:
        VITE_API_URL: "/api"
        VITE_OIDC_ENABLED: ${VITE_OIDC_ENABLED:-true}
        VITE_OIDC_ISSUER: ${VITE_OIDC_ISSUER}
        VITE_OIDC_CLIENT_ID: ${VITE_OIDC_CLIENT_ID}
        VITE_OIDC_SCOPE: ${VITE_OIDC_SCOPE:-openid profile email}
        VITE_OIDC_REDIRECT_URI: ${VITE_OIDC_REDIRECT_URI}
        VITE_OIDC_POST_LOGOUT_REDIRECT_URI: ${VITE_OIDC_POST_LOGOUT_REDIRECT_URI}
        VITE_DEV_API_PROXY_TARGET: "http://backend:8000"
    depends_on:
      backend:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${APP_NAME}.rule=Host(`${APP_HOST}`)"
      - "traefik.http.routers.${APP_NAME}.entrypoints=websecure"
      - "traefik.http.routers.${APP_NAME}.tls.certresolver=${CERT_RESOLVER}"
      - "traefik.http.services.${APP_NAME}.loadbalancer.server.port=${APP_PORT}"
    ports:
      - "8080:80"
    restart: unless-stopped