services:
  katheryn-frontend:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        - DIRECTUS_API_TOKEN=katheryn-frontend-readonly-8591de0316ded82fab45328cf1e49cb1
        - NEXT_PUBLIC_PAYPAL_CLIENT_ID=AfQqEsrGHMOTawmNO_Sh1sEG-3lpqueUj3K5rAu0d0iKl0d_NTUZbalpujXPKYxa9QukJeFtmNF52hcY
    container_name: katheryn-frontend
    restart: unless-stopped
    environment:
      - NEXT_PUBLIC_DIRECTUS_URL=https://katheryn-cms.jeffemmett.com
      - DIRECTUS_API_TOKEN=katheryn-frontend-readonly-8591de0316ded82fab45328cf1e49cb1
      - DIRECTUS_INTERNAL_URL=http://katheryn-cms:8055
      - DIRECTUS_STORE_TOKEN=katheryn-store-backend-9f3a7c1d2e4b5608
      - NEXT_PUBLIC_PAYPAL_CLIENT_ID=AfQqEsrGHMOTawmNO_Sh1sEG-3lpqueUj3K5rAu0d0iKl0d_NTUZbalpujXPKYxa9QukJeFtmNF52hcY
      - PAYPAL_CLIENT_ID=AfQqEsrGHMOTawmNO_Sh1sEG-3lpqueUj3K5rAu0d0iKl0d_NTUZbalpujXPKYxa9QukJeFtmNF52hcY
      - PAYPAL_CLIENT_SECRET=EP8vrmH8vOLCOSfwX1tIZFLpHiPOz2r_XfVSdmWDYFY5BUBsMtGA1w8y2W5X4FwDgkm8eNlribaQW7O_
      - PAYPAL_MODE=sandbox
      - SMTP_HOST=mail.rmail.online
      - SMTP_PORT=587
      - SMTP_USER=orders@katheryntrenshaw.com
      - SMTP_PASS=rMailRelay2026!svc
      - SMTP_FROM=orders@katheryntrenshaw.com
    labels:
      - "traefik.enable=true"
      # Staging
      - "traefik.http.routers.katheryn-staging.rule=Host(`katheryn-staging.jeffemmett.com`)"
      - "traefik.http.routers.katheryn-staging.entrypoints=web"
      - "traefik.http.services.katheryn-staging.loadbalancer.server.port=3000"
      # Production domains
      - "traefik.http.routers.katheryn-prod.rule=Host(`katheryntrenshaw.com`) || Host(`www.katheryntrenshaw.com`)"
      - "traefik.http.routers.katheryn-prod.entrypoints=web"
      - "traefik.http.routers.katheryn-prod.service=katheryn-staging"
      # ktrenshaw.com → 301 redirect to katheryntrenshaw.com
      - "traefik.http.routers.ktrenshaw-redirect.rule=Host(`ktrenshaw.com`) || Host(`www.ktrenshaw.com`)"
      - "traefik.http.routers.ktrenshaw-redirect.entrypoints=web"
      - "traefik.http.routers.ktrenshaw-redirect.middlewares=ktrenshaw-to-katheryn"
      - "traefik.http.routers.ktrenshaw-redirect.service=katheryn-staging"
      - "traefik.http.middlewares.ktrenshaw-to-katheryn.redirectregex.regex=^https?://(?:www\\.)?ktrenshaw\\.com(.*)"
      - "traefik.http.middlewares.ktrenshaw-to-katheryn.redirectregex.replacement=https://katheryntrenshaw.com$${1}"
      - "traefik.http.middlewares.ktrenshaw-to-katheryn.redirectregex.permanent=true"
      # inyourownskin.org → 301 redirect to katheryntrenshaw.com/in-your-own-skin
      - "traefik.http.routers.iyos-redirect.rule=Host(`inyourownskin.org`) || Host(`www.inyourownskin.org`)"
      - "traefik.http.routers.iyos-redirect.entrypoints=web"
      - "traefik.http.routers.iyos-redirect.middlewares=iyos-to-katheryn"
      - "traefik.http.routers.iyos-redirect.service=katheryn-staging"
      - "traefik.http.middlewares.iyos-to-katheryn.redirectregex.regex=^https?://(?:www\\.)?inyourownskin\\.org(.*)"
      - "traefik.http.middlewares.iyos-to-katheryn.redirectregex.replacement=https://katheryntrenshaw.com/in-your-own-skin"
      - "traefik.http.middlewares.iyos-to-katheryn.redirectregex.permanent=true"
      # passionatepresence.org → 301 redirect to katheryntrenshaw.com/passionate-presence-centre
      - "traefik.http.routers.ppc-redirect.rule=Host(`passionatepresence.org`) || Host(`www.passionatepresence.org`)"
      - "traefik.http.routers.ppc-redirect.entrypoints=web"
      - "traefik.http.routers.ppc-redirect.middlewares=ppc-to-katheryn"
      - "traefik.http.routers.ppc-redirect.service=katheryn-staging"
      - "traefik.http.middlewares.ppc-to-katheryn.redirectregex.regex=^https?://(?:www\\.)?passionatepresence\\.org(.*)"
      - "traefik.http.middlewares.ppc-to-katheryn.redirectregex.replacement=https://katheryntrenshaw.com/passionate-presence-centre"
      - "traefik.http.middlewares.ppc-to-katheryn.redirectregex.permanent=true"
    networks:
      - traefik-public
      - directus_katheryn-internal
    read_only: true
    tmpfs:
      - /tmp
      - /app/.next/cache
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true

networks:
  traefik-public:
    external: true
  directus_katheryn-internal:
    external: true