services:
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - internal
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure

  backend:
    image: ${REGISTRY}/saas-imobiliaria-backend:${IMAGE_TAG:-latest}
    environment:
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}
      SECRET_KEY: ${SECRET_KEY}
      JWT_SECRET_KEY: ${JWT_SECRET_KEY}
      FLASK_ENV: production
      FLASK_APP: app
      CORS_ORIGINS: https://${DOMAIN}
      IMAGE_TAG: ${IMAGE_TAG:-latest}
    networks:
      - internal
      - proxy
    deploy:
      replicas: 1
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 5
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        # Router HTTPS
        - "traefik.http.routers.imob-api.rule=Host(`${DOMAIN}`) && PathPrefix(`/api`)"
        - "traefik.http.routers.imob-api.entrypoints=websecure"
        - "traefik.http.routers.imob-api.tls=true"
        - "traefik.http.routers.imob-api.tls.certresolver=letsencrypt"
        - "traefik.http.routers.imob-api.middlewares=imob-strip-api"
        # Strip /api prefix antes de chegar no Flask
        - "traefik.http.middlewares.imob-strip-api.stripprefix.prefixes=/api"
        # Service
        - "traefik.http.services.imob-api.loadbalancer.server.port=5000"

  frontend:
    image: ${REGISTRY}/saas-imobiliaria-frontend:${IMAGE_TAG:-latest}
    networks:
      - proxy
    deploy:
      replicas: 1
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 5
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=proxy"
        # Router HTTPS
        - "traefik.http.routers.imob-frontend.rule=Host(`${DOMAIN}`)"
        - "traefik.http.routers.imob-frontend.entrypoints=websecure"
        - "traefik.http.routers.imob-frontend.tls=true"
        - "traefik.http.routers.imob-frontend.tls.certresolver=letsencrypt"
        # Service
        - "traefik.http.services.imob-frontend.loadbalancer.server.port=80"

networks:
  internal:
    driver: overlay
  proxy:
    external: true

volumes:
  postgres_data: