# Balinyaar — full stack for the balinyaar.ir deployment.
#
# Three containers, no published ports: everything is reached through the EXISTING Caddy on `caddy_net`,
# which terminates TLS for balinyaar.ir (→ web) and api.balinyaar.ir (→ api). See DEPLOY.md for the
# Caddyfile block to add, and deploy/Caddyfile for a copy of it.
#
# The database is NOT here — it is the remote SQL Server already configured in
# server/src/API/Baya.Web.Api/appsettings.Development.json.
#
#   docker compose up -d --build
#   docker compose logs -f api

services:
  api:
    build:
      context: ./server
    image: balinyaar-api
    container_name: balinyaar-api
    restart: unless-stopped
    depends_on:
      - otp-relay
    environment:
      # Deliberate: the deployed API runs as Development so the demo + lifecycle seeders populate the
      # shared database and the screens aren't empty. This also exposes the developer exception page and
      # GET /api/v1/dev/last_otp/{phone} publicly — acceptable for a pre-launch demo, NOT for real users.
      # Switch to Production (and supply non-placeholder crypto keys) before launch — see DEPLOY.md.
      ASPNETCORE_ENVIRONMENT: Development

      # The two values that genuinely differ between a laptop and this network. Everything else — crypto
      # keys, connection strings, CORS origins, trusted proxy networks — lives in appsettings.Development.json.
      Seams__Sms__Telegram__BaseUrl: http://balinyaar-otp-relay:5010
      Seams__ObjectStorage__RootPath: /app/data/object-storage
    volumes:
      # Uploaded verification documents live on the local-disk object-storage seam; without this they are
      # inside the container and vanish on the next `up --build`.
      - api-object-storage:/app/data/object-storage
      - api-logs:/app/logs
    networks:
      - caddy_net

  web:
    build:
      context: ./client
    image: balinyaar-web
    container_name: balinyaar-web
    restart: unless-stopped
    depends_on:
      - api
    # No environment here on purpose: every NEXT_PUBLIC_* value is compiled into the browser bundle at
    # build time from client/.env.production. Setting one here would be silently ignored.
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    networks:
      - caddy_net

  otp-relay:
    build:
      context: ./telegram-otp-bot
    image: balinyaar-otp-relay
    container_name: balinyaar-otp-relay
    restart: unless-stopped
    environment:
      TELEGRAM_BOT_TOKEN: "8968527151:AAFiCuNGkXjOiLZfT6urU8tkW8SCsWDM0ic"
      # Every id here receives EVERY login code, for every phone number. Keep it to people you trust.
      TELEGRAM_CHAT_IDS: "1277103616,110209855"
      # Must equal Seams:Sms:Telegram:ApiKey in the API's appsettings.Development.json.
      API_KEY: "6a8dfaeea1aa375eb61da7663cadf23a3ea245fd939264dd"
      # api.telegram.org is filtered in Iran — this hop goes out through the proxy container that already
      # sits on caddy_net. A wrong value fails at boot with a clear message rather than per-OTP.
      TELEGRAM_PROXY_URL: http://hysteria-client:8081
      # The code still arrives on Telegram; keeping it out of `docker logs` means a host-log reader can't
      # harvest login codes.
      REDACT_CODE_IN_LOGS: "true"
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:5010/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - caddy_net

volumes:
  api-object-storage:
  api-logs:

networks:
  caddy_net:
    external: true