# OpenResto — self-hosted breakfast booking (Lunkaberg)
#
# Adapted from the official release compose (v2.2.0) to run behind the
# existing Nginx Proxy Manager setup on this server: no host ports are
# published, all services join the shared `my-main-net` network, and NPM
# proxies straight to the `lunkaberg-reverse-proxy` container on port 80.
#
# Backup: see https://github.com/karanshukla/openresto/blob/main/docs/backup-restore.md

volumes:
  db_data:
  media_data:

networks:
  main:
    external: true
    name: my-main-net

services:
  backend:
    image: ghcr.io/karanshukla/openresto-backend:2.2.0
    container_name: lunkaberg-backend
    restart: unless-stopped
    networks:
      - main
    environment:
      - ASPNETCORE_ENVIRONMENT=Production
      - PORT=8080
      - CORS_ORIGINS=${CORS_ORIGINS}
      - JWT_KEY=${JWT_KEY}
      - ADMIN_EMAIL=${ADMIN_EMAIL}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
      - CONNECTION_STRING=Data Source=/data/openresto.db
      - DATA_PROTECTION_KEYS_PATH=/data/dp-keys
      - Vapid__PublicKey=${VAPID_PUBLIC_KEY:-}
      - Vapid__PrivateKey=${VAPID_PRIVATE_KEY:-}
      - Vapid__Subject=${VAPID_SUBJECT:-}
      - GuestPush__ReminderLeadHours=${GUEST_PUSH_REMINDER_LEAD_HOURS:-24,2}
      - GuestPush__ExpoAccessToken=${EXPO_ACCESS_TOKEN:-}
      - Wallet__Apple__PassTypeIdentifier=${APPLE_PASS_TYPE_ID:-}
      - Wallet__Apple__TeamIdentifier=${APPLE_TEAM_ID:-}
      - Wallet__Apple__CertificatePath=${APPLE_PASS_CERTIFICATE_PATH:-}
      - Wallet__Apple__CertificatePassword=${APPLE_PASS_CERTIFICATE_PASSWORD:-}
      - Wallet__Apple__WwdrCertificatePath=${APPLE_WWDR_CERTIFICATE_PATH:-}
      - Wallet__Google__IssuerId=${GOOGLE_WALLET_ISSUER_ID:-}
      - Wallet__Google__ServiceAccountKeyPath=${GOOGLE_WALLET_SERVICE_ACCOUNT_KEY_PATH:-}
      - EmailSettings__Host=${SMTP_HOST:-}
      - EmailSettings__Port=${SMTP_PORT:-587}
      - EmailSettings__Username=${SMTP_USERNAME:-}
      - EmailSettings__Password=${SMTP_PASSWORD:-}
      - EmailSettings__FromEmail=${SMTP_FROM_EMAIL:-}
      - EmailSettings__FromName=${SMTP_FROM_NAME:-Lunkaberg Frukost}
      - EmailSettings__EnableSsl=${SMTP_ENABLE_SSL:-true}
    volumes:
      - db_data:/data
      - media_data:/app/wwwroot/media
      - ./wallet:/wallet:ro
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  frontend:
    image: ghcr.io/karanshukla/openresto-frontend:2.2.0
    container_name: lunkaberg-frontend
    restart: unless-stopped
    networks:
      - main
    environment:
      - EXPO_PUBLIC_API_URL=/api
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8081"]
      interval: 10s
      timeout: 5s
      retries: 3

  reverse-proxy:
    image: ghcr.io/karanshukla/openresto-nginx:2.2.0
    container_name: lunkaberg-reverse-proxy
    restart: unless-stopped
    networks:
      - main
    # No host port published — Nginx Proxy Manager reaches this container
    # directly on my-main-net at lunkaberg-reverse-proxy:80.
    environment:
      - PORT=80
      - BACKEND_HOST=backend
      - BACKEND_PORT=8080
      - FRONTEND_HOST=frontend
      - FRONTEND_PORT=8081
    volumes:
      - media_data:/usr/share/nginx/html/media:ro
      - ./well-known:/usr/share/nginx/html/.well-known:ro
    depends_on:
      backend:
        condition: service_healthy
      frontend:
        condition: service_healthy