services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: inkreach
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: inkreach
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U inkreach -d inkreach"]
      interval: 10s
      timeout: 5s
      retries: 10
    # No ports exposed: only reachable from the compose network

  api:
    build:
      context: ..
      dockerfile: deploy/api.Dockerfile
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: 3001
      DATABASE_URL: postgresql://inkreach:${POSTGRES_PASSWORD}@postgres:5432/inkreach
      JWT_SECRET: ${JWT_SECRET}
      CORS_ORIGINS: "*"
    volumes:
      - uploads:/app/uploads

  admin:
    build:
      context: ..
      dockerfile: deploy/admin.Dockerfile
      args:
        VITE_API_BASE: /api
    restart: unless-stopped
    depends_on:
      - api
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/admin.conf:/etc/nginx/conf.d/default.conf:ro
      - ./certbot/www:/var/www/certbot:ro
      - ./certbot/acme:/etc/nginx/certs:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      default:
      shared:
        # 接入 v2 栈的共享网络，使 /v2/* 的 proxy_pass 能解析 v2-admin / v2-api
        aliases:
          - v1-admin

volumes:
  pgdata:
  uploads:

networks:
  shared:
    external: true
    name: inkreach-shared