# EncryptID Docker Compose
# Deploy with: docker compose -f docker-compose.encryptid.yml up -d

services:
  encryptid:
    build:
      context: .
      dockerfile: Dockerfile.encryptid
      additional_contexts:
        encryptid-sdk: ../encryptid-sdk
    container_name: encryptid
    restart: unless-stopped
    depends_on:
      encryptid-db:
        condition: service_healthy
    environment:
      - NODE_ENV=production
      - PORT=3000
      - JWT_SECRET=${JWT_SECRET}
      - DATABASE_URL=postgres://encryptid:${ENCRYPTID_DB_PASSWORD}@encryptid-db:5432/encryptid
      - SMTP_HOST=${SMTP_HOST:-mail.rmail.online}
      - SMTP_PORT=${SMTP_PORT:-587}
      - SMTP_USER=${SMTP_USER:-noreply@rspace.online}
      - SMTP_PASS=${SMTP_PASS}
      - SMTP_FROM=${SMTP_FROM:-EncryptID <noreply@rspace.online>}
      - RECOVERY_URL=${RECOVERY_URL:-https://auth.rspace.online/recover}
      - MAILCOW_API_URL=${MAILCOW_API_URL:-http://nginx-mailcow:8080}
      - MAILCOW_API_KEY=${MAILCOW_API_KEY:-}
      - ADMIN_DIDS=${ADMIN_DIDS}
      - OIDC_ISSUER=${OIDC_ISSUER:-https://auth.ridentity.online}
      - OIDC_CLIENTS=${OIDC_CLIENTS:-}
    labels:
      # Traefik auto-discovery
      - "traefik.enable=true"
      - "traefik.http.routers.encryptid.rule=Host(`auth.rspace.online`) || Host(`auth.ridentity.online`) || Host(`encryptid.jeffemmett.com`)"
      - "traefik.http.routers.encryptid.entrypoints=web"
      - "traefik.http.routers.encryptid.priority=150"
      - "traefik.http.services.encryptid.loadbalancer.server.port=3000"
      # Also serve from RP ID domain for .well-known (WebAuthn Related Origins)
      - "traefik.http.routers.encryptid-wellknown.rule=Host(`rspace.online`) && PathPrefix(`/.well-known/webauthn`)"
      - "traefik.http.routers.encryptid-wellknown.entrypoints=web"
      - "traefik.http.routers.encryptid-wellknown.priority=200"
      - "traefik.http.routers.encryptid-wellknown.service=encryptid"
      # Serve .well-known/webauthn from ridentity.online too
      - "traefik.http.routers.encryptid-wellknown-rid.rule=Host(`ridentity.online`) && PathPrefix(`/.well-known/webauthn`)"
      - "traefik.http.routers.encryptid-wellknown-rid.entrypoints=web"
      - "traefik.http.routers.encryptid-wellknown-rid.priority=200"
      - "traefik.http.routers.encryptid-wellknown-rid.service=encryptid"
    networks:
      - traefik-public
      - encryptid-internal
      - rmail-mailcow
    healthcheck:
      test: ["CMD", "bun", "-e", "fetch('http://localhost:3000/health').then(r => r.json()).then(d => process.exit(d.database ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  encryptid-db:
    image: postgres:16-alpine
    container_name: encryptid-db
    restart: unless-stopped
    environment:
      - POSTGRES_DB=encryptid
      - POSTGRES_USER=encryptid
      - POSTGRES_PASSWORD=${ENCRYPTID_DB_PASSWORD}
    volumes:
      - encryptid-pgdata:/var/lib/postgresql/data
    networks:
      - encryptid-internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U encryptid -d encryptid"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

volumes:
  encryptid-pgdata:

networks:
  traefik-public:
    external: true
  encryptid-internal:
    driver: bridge
  rmail-mailcow:
    external: true
    name: mailcowdockerized_mailcow-network
