version: "3.8"

networks:
  proxy-net:
    external: true
  recipesage-internal:
    internal: true

services:
  proxy:
    image: julianpoy/recipesage-selfhost-proxy:v4.0.0
    container_name: recipesage_proxy
    restart: unless-stopped
    networks:
      - proxy-net
      - recipesage-internal
    depends_on:
      - static
      - api
      - pushpin
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy-net"

      # --- 1. Authenticated Router (Priority 10) ---
      - "traefik.http.routers.recipesage.rule=Host(`${DOMAIN_NAME}`)"
      - "traefik.http.routers.recipesage.entrypoints=websecure"
      - "traefik.http.routers.recipesage.tls=true"
      - "traefik.http.routers.recipesage.tls.certresolver=cloudflare"
      - "traefik.http.routers.recipesage.middlewares=authentik-auth@file"
      - "traefik.http.routers.recipesage.priority=10"
      - "traefik.http.routers.recipesage.service=recipesage-svc"

      # --- 2. Public Share Bypass Router (Priority 20) ---
      # Bypasses Authentik for public share links, shared profile routes, and media assets
      - "traefik.http.routers.recipesage-public.rule=Host(`${DOMAIN_NAME}`) && (PathPrefix(`/share`) || PathPrefix(`/p/`) || PathPrefix(`/api/v1/share`) || PathPrefix(`/assets/`))"
      - "traefik.http.routers.recipesage-public.entrypoints=websecure"
      - "traefik.http.routers.recipesage-public.tls=true"
      - "traefik.http.routers.recipesage-public.tls.certresolver=cloudflare"
      - "traefik.http.routers.recipesage-public.priority=20"
      - "traefik.http.routers.recipesage-public.service=recipesage-svc"

      # --- Service Target Port ---
      - "traefik.http.services.recipesage-svc.loadbalancer.server.port=80"

  api:
    image: julianpoy/recipesage-selfhost:api-v3.0.10
    container_name: recipesage_api
    restart: unless-stopped
    networks:
      - recipesage-internal
    environment:
      - NODE_ENV=production
      - PORT=3000
      - DATABASE_URL=postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?schema=public
      - JWT_SECRET=${JWT_SECRET}
      - DISABLE_REGISTRATION=${DISABLE_REGISTRATION}
      - BROWSERLESS_URL=http://browserless:3000
      - PUSHPIN_URL=http://pushpin:7999
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
      - OPENAI_API_BASE_URL=${OPENAI_API_BASE_URL:-}
    volumes:
      - /mnt/appdata/recipesage/data/uploads:/app/uploads
    depends_on:
      postgres:
        condition: service_healthy

  static:
    image: julianpoy/recipesage-selfhost:static-v3.0.10
    container_name: recipesage_static
    restart: unless-stopped
    networks:
      - recipesage-internal

  pushpin:
    image: fanout/pushpin:1.37.0
    container_name: recipesage_pushpin
    restart: unless-stopped
    networks:
      - recipesage-internal

  browserless:
    image: browserless/chrome:1.53.0-puppeteer-10.1.0
    container_name: recipesage_browserless
    restart: unless-stopped
    networks:
      - recipesage-internal
    environment:
      - MAX_CONCURRENT_SESSIONS=5

  postgres:
    image: postgres:15-alpine
    container_name: recipesage_postgres
    restart: unless-stopped
    networks:
      - recipesage-internal
    environment:
      - POSTGRES_DB=${POSTGRES_DB}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
    volumes:
      - /mnt/appdata/recipesage/data/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 5