services:
  db:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      PGUSER: postgres
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: zitadel
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d zitadel -U postgres"]
      interval: 10s
      timeout: 30s
      retries: 10
      start_period: 20s
    volumes:
      - postgres_data:/var/lib/postgresql/data

  zitadel:
    image: ghcr.io/zitadel/zitadel:v4.13.0
    user: "0:0"
    restart: unless-stopped
    command: 'start-from-init --masterkey "${ZITADEL_MASTERKEY}" --tlsMode disabled'
    environment:
      ZITADEL_DATABASE_POSTGRES_DSN: postgresql://postgres:${POSTGRES_PASSWORD}@db:5432/zitadel?sslmode=disable

      ZITADEL_EXTERNALSECURE: false
      ZITADEL_EXTERNALPORT: 8081
      ZITADEL_EXTERNALDOMAIN: zitadel.localhost
      ZITADEL_TLS_ENABLED: false

      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED: false
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME: ${ZITADEL_ADMIN_USERNAME}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_ADDRESS: ${ZITADEL_ADMIN_EMAIL}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_EMAIL_VERIFIED: true
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD: ${ZITADEL_ADMIN_PASSWORD}

      # PAT для API provision/user registration.
      ZITADEL_FIRSTINSTANCE_PATPATH: /zitadel-secrets/admin.pat
      ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME: mm-admin-machine
      ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME: Million Miles Admin Machine
      ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE: '2029-01-01T00:00:00Z'

      # PAT для Session API / Auth Request finalize.
      ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH: /zitadel-secrets/login-client.pat
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME: mm-login-client
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME: Million Miles Login Client
      ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE: '2029-01-01T00:00:00Z'
    depends_on:
      db:
        condition: service_healthy
    expose:
      - "8080"
    volumes:
      - zitadel_data:/app/data
      - zitadel_secrets:/zitadel-secrets

  frontend:
    build: ./frontend
    restart: unless-stopped
    environment:
      APP_URL: ${APP_URL}
      ZITADEL_URL: ${ZITADEL_URL}
      ZITADEL_PUBLIC_URL: ${ZITADEL_PUBLIC_URL}
      ZITADEL_PROJECT_NAME: ${ZITADEL_PROJECT_NAME}
      OIDC_APP_NAME: ${OIDC_APP_NAME}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
      ZITADEL_SERVICE_TOKEN_FILE: ${ZITADEL_SERVICE_TOKEN_FILE}
      ZITADEL_LOGIN_CLIENT_TOKEN_FILE: ${ZITADEL_LOGIN_CLIENT_TOKEN_FILE}
      SESSION_SECRET: ${SESSION_SECRET}
      AUTH_DEBUG: ${AUTH_DEBUG}
    expose:
      - "3000"
    depends_on:
      - zitadel
    extra_hosts:
      - "host.docker.internal:host-gateway"
      - "zitadel.localhost:host-gateway"
    volumes:
      - zitadel_secrets:/zitadel-secrets

volumes:
  postgres_data:
  zitadel_data:
  zitadel_secrets: