services:
  postiz-rsocials:
    image: ghcr.io/gitroomhq/postiz-app:latest
    container_name: postiz-rsocials
    restart: always
    environment:
      MAIN_URL: 'https://socials.rsocials.online'
      FRONTEND_URL: 'https://socials.rsocials.online'
      NEXT_PUBLIC_BACKEND_URL: 'https://socials.rsocials.online/api'
      JWT_SECRET: '${JWT_SECRET}'
      DATABASE_URL: 'postgresql://postiz:${POSTGRES_PASSWORD}@postiz-rsocials-postgres:5432/postiz'
      REDIS_URL: 'redis://postiz-rsocials-redis:6379'
      BACKEND_INTERNAL_URL: 'http://localhost:3000'
      TEMPORAL_ADDRESS: "postiz-rsocials-temporal:7233"
      IS_GENERAL: 'true'
      DISABLE_REGISTRATION: 'false'

      # Storage
      STORAGE_PROVIDER: 'local'
      UPLOAD_DIRECTORY: '/uploads'
      NEXT_PUBLIC_UPLOAD_DIRECTORY: '/uploads'

      # Social Media API Settings (configure in .env)
      X_API_KEY: '${X_API_KEY:-}'
      X_API_SECRET: '${X_API_SECRET:-}'
      LINKEDIN_CLIENT_ID: '${LINKEDIN_CLIENT_ID:-}'
      LINKEDIN_CLIENT_SECRET: '${LINKEDIN_CLIENT_SECRET:-}'
      REDDIT_CLIENT_ID: '${REDDIT_CLIENT_ID:-}'
      REDDIT_CLIENT_SECRET: '${REDDIT_CLIENT_SECRET:-}'
      THREADS_APP_ID: '${THREADS_APP_ID:-}'
      THREADS_APP_SECRET: '${THREADS_APP_SECRET:-}'
      FACEBOOK_APP_ID: '${FACEBOOK_APP_ID:-}'
      FACEBOOK_APP_SECRET: '${FACEBOOK_APP_SECRET:-}'
      YOUTUBE_CLIENT_ID: '${YOUTUBE_CLIENT_ID:-}'
      YOUTUBE_CLIENT_SECRET: '${YOUTUBE_CLIENT_SECRET:-}'
      TIKTOK_CLIENT_ID: '${TIKTOK_CLIENT_ID:-}'
      TIKTOK_CLIENT_SECRET: '${TIKTOK_CLIENT_SECRET:-}'
      DISCORD_CLIENT_ID: '${DISCORD_CLIENT_ID:-}'
      DISCORD_CLIENT_SECRET: '${DISCORD_CLIENT_SECRET:-}'
      DISCORD_BOT_TOKEN_ID: '${DISCORD_BOT_TOKEN_ID:-}'
      MASTODON_URL: '${MASTODON_URL:-https://mastodon.social}'
      MASTODON_CLIENT_ID: '${MASTODON_CLIENT_ID:-}'
      MASTODON_CLIENT_SECRET: '${MASTODON_CLIENT_SECRET:-}'
      SLACK_ID: '${SLACK_ID:-}'
      SLACK_SECRET: '${SLACK_SECRET:-}'
      SLACK_SIGNING_SECRET: '${SLACK_SIGNING_SECRET:-}'
      PINTEREST_CLIENT_ID: '${PINTEREST_CLIENT_ID:-}'
      PINTEREST_CLIENT_SECRET: '${PINTEREST_CLIENT_SECRET:-}'

      # Email (SMTP via Mailcow / mail.rmail.online)
      EMAIL_PROVIDER: 'nodemailer'
      EMAIL_FROM_NAME: 'rSocials'
      EMAIL_FROM_ADDRESS: 'noreply@rmail.online'
      EMAIL_HOST: 'mailcowdockerized-postfix-mailcow-1'
      EMAIL_PORT: '587'
      EMAIL_SECURE: 'false'
      EMAIL_USER: 'noreply@rmail.online'
      EMAIL_PASS: '${EMAIL_PASS}'
      NODE_TLS_REJECT_UNAUTHORIZED: '0'

      # AI
      OPENAI_API_KEY: '${OPENAI_API_KEY:-}'

      # Misc
      NX_ADD_PLUGINS: false
      API_LIMIT: 30

    volumes:
      - postiz-rsocials-config:/config/
      - postiz-rsocials-uploads:/uploads/
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.postiz-rsocials.rule=Host(`socials.rsocials.online`)"
      - "traefik.http.routers.postiz-rsocials.entrypoints=web"
      - "traefik.http.services.postiz-rsocials.loadbalancer.server.port=5000"
      - "traefik.docker.network=traefik-public"
    networks:
      - traefik-public
      - postiz-rsocials-internal
      - mailcow-network
    depends_on:
      postiz-rsocials-postgres:
        condition: service_healthy
      postiz-rsocials-redis:
        condition: service_healthy

  postiz-rsocials-postgres:
    image: postgres:17-alpine
    container_name: postiz-rsocials-postgres
    restart: always
    environment:
      POSTGRES_PASSWORD: '${POSTGRES_PASSWORD}'
      POSTGRES_USER: postiz
      POSTGRES_DB: postiz
    volumes:
      - postiz-rsocials-postgres-data:/var/lib/postgresql/data
    networks:
      - postiz-rsocials-internal
    healthcheck:
      test: pg_isready -U postiz -d postiz
      interval: 10s
      timeout: 3s
      retries: 3
    cap_drop:
      - ALL
    cap_add:
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true

  postiz-rsocials-redis:
    image: redis:7.2
    container_name: postiz-rsocials-redis
    restart: always
    healthcheck:
      test: redis-cli ping
      interval: 10s
      timeout: 3s
      retries: 3
    volumes:
      - postiz-rsocials-redis-data:/data
    networks:
      - postiz-rsocials-internal
    cap_drop:
      - ALL
    cap_add:
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true

  # Temporal Stack (Workflow Engine for scheduling)
  postiz-rsocials-temporal-postgres:
    image: postgres:16
    container_name: postiz-rsocials-temporal-postgres
    restart: always
    environment:
      POSTGRES_PASSWORD: temporal
      POSTGRES_USER: temporal
    networks:
      - postiz-rsocials-internal
    volumes:
      - postiz-rsocials-temporal-postgres-data:/var/lib/postgresql/data
    cap_drop:
      - ALL
    cap_add:
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true

  postiz-rsocials-temporal:
    image: temporalio/auto-setup:1.28.1
    container_name: postiz-rsocials-temporal
    restart: always
    depends_on:
      - postiz-rsocials-temporal-postgres
    environment:
      - DB=postgres12
      - DB_PORT=5432
      - POSTGRES_USER=temporal
      - POSTGRES_PWD=temporal
      - POSTGRES_SEEDS=postiz-rsocials-temporal-postgres
      - TEMPORAL_NAMESPACE=default
    networks:
      - postiz-rsocials-internal

volumes:
  postiz-rsocials-postgres-data:
  postiz-rsocials-redis-data:
  postiz-rsocials-config:
  postiz-rsocials-uploads:
  postiz-rsocials-temporal-postgres-data:

networks:
  traefik-public:
    external: true
  postiz-rsocials-internal:
    internal: true
  mailcow-network:
    external: true
    name: mailcowdockerized_mailcow-network