services:
  backend:
    build:
      context: .
      dockerfile: backend/Dockerfile
    environment:
      AUTH_ENABLED: ${AUTH_ENABLED:-true}
      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL:?set OIDC_ISSUER_URL}
      OIDC_AUDIENCE: ${OIDC_AUDIENCE:?set OIDC_AUDIENCE}
      OIDC_JWKS_URL: ${OIDC_JWKS_URL:-}
      OIDC_CLOCK_SKEW_SECONDS: ${OIDC_CLOCK_SKEW_SECONDS:-30}
      JELLYFIN_URL: ${JELLYFIN_URL:?set JELLYFIN_URL}
      JELLYFIN_API_KEY: ${JELLYFIN_API_KEY:?set JELLYFIN_API_KEY}
      JELLYFIN_USER_ID: ${JELLYFIN_USER_ID:-}
      JELLYSEERR_URL: ${JELLYSEERR_URL:-}
      JELLYSEERR_API_KEY: ${JELLYSEERR_API_KEY:-}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM_ADDRESS: ${SMTP_FROM_ADDRESS:-}
      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-Manage}
      SMTP_USE_TLS: ${SMTP_USE_TLS:-true}
      SMTP_USE_SSL: ${SMTP_USE_SSL:-false}
      SMTP_TIMEOUT: ${SMTP_TIMEOUT:-30}
      SSH_HOST: ${SSH_HOST:?set SSH_HOST}
      SSH_USERNAME: ${SSH_USERNAME:?set SSH_USERNAME}
      SSH_PORT: ${SSH_PORT:-22}
      SSH_KEY_DIRECTORY: /root/.ssh
      SSH_KEY_NAME: ${SSH_KEY_NAME:?set SSH_KEY_NAME}
      SSH_PASSWORD: ${SSH_PASSWORD:-}
      REMOTE_MEDIA_ROOT: ${REMOTE_MEDIA_ROOT:-}
      REMOTE_PATH_PREFIX: ${REMOTE_PATH_PREFIX:-}
    volumes:
      - ${SSH_KEY_HOST_DIR:?set SSH_KEY_HOST_DIR}:/root/.ssh:ro
      - backend_cache:/app/backend/.cache
    restart: unless-stopped
    networks:
      - web
    expose:
      - "8000"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${BACKEND_APP_NAME:-manage-backend}.rule=Host(`${BACKEND_APP_HOST:?set BACKEND_APP_HOST}`)"
      - "traefik.http.routers.${BACKEND_APP_NAME:-manage-backend}.entrypoints=websecure"
      - "traefik.http.routers.${BACKEND_APP_NAME:-manage-backend}.tls.certresolver=${CERT_RESOLVER:?set CERT_RESOLVER}"
      - "traefik.http.services.${BACKEND_APP_NAME:-manage-backend}.loadbalancer.server.port=${BACKEND_APP_PORT:-8000}"
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import json, urllib.request; print(json.load(urllib.request.urlopen('http://127.0.0.1:8000/api/health'))['status'])",
        ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s

  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
      target: prod
      args:
        VITE_API_URL: ${VITE_API_URL:-/api}
        VITE_OIDC_ENABLED: ${VITE_OIDC_ENABLED:-true}
        VITE_OIDC_ISSUER: ${VITE_OIDC_ISSUER:?set VITE_OIDC_ISSUER}
        VITE_OIDC_CLIENT_ID: ${VITE_OIDC_CLIENT_ID:?set VITE_OIDC_CLIENT_ID}
        VITE_OIDC_SCOPE: ${VITE_OIDC_SCOPE:-openid profile email}
        VITE_OIDC_REDIRECT_URI: ${VITE_OIDC_REDIRECT_URI:?set VITE_OIDC_REDIRECT_URI}
        VITE_OIDC_POST_LOGOUT_REDIRECT_URI: ${VITE_OIDC_POST_LOGOUT_REDIRECT_URI:?set VITE_OIDC_POST_LOGOUT_REDIRECT_URI}
        VITE_DEV_API_PROXY_TARGET: ${VITE_DEV_API_PROXY_TARGET:-http://backend:8000}
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${FRONTEND_APP_NAME:-manage-frontend}.rule=Host(`${FRONTEND_APP_HOST:?set FRONTEND_APP_HOST}`)"
      - "traefik.http.routers.${FRONTEND_APP_NAME:-manage-frontend}.entrypoints=websecure"
      - "traefik.http.routers.${FRONTEND_APP_NAME:-manage-frontend}.tls.certresolver=${CERT_RESOLVER:?set CERT_RESOLVER}"
      - "traefik.http.services.${FRONTEND_APP_NAME:-manage-frontend}.loadbalancer.server.port=${FRONTEND_APP_PORT:-80}"
    ports:
      - "8080:80"
    restart: unless-stopped

volumes:
  backend_cache:

networks:
  web:
    external: true