# NV Core — full stack with one command:
#   docker compose up --build
# Then open http://localhost:3000 (API at http://localhost:4000/api).
#
# Override secrets via a root .env file (see .env.docker.example).

services:
  db:
    image: postgres:16
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-nvcore}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-nvcore}
      POSTGRES_DB: ${POSTGRES_DB:-nvcore}
    # Sin puerto al host: la API se conecta por la red interna (db:5432).
    # Así no choca con un PostgreSQL local que uses en el 5432.
    volumes:
      - nvcore-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-nvcore}"]
      interval: 5s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7-alpine
    # Sin puerto al host: solo lo usa la API por la red interna (redis:6379).
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 10

  api:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    environment:
      NODE_ENV: production
      PORT: 4000
      CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000}
      # Secretos SIN default: crea un `.env` en la raíz (ver .env.docker.example).
      # En producción la API no arranca si faltan JWT_SECRET/ENCRYPTION_KEY.
      JWT_SECRET: ${JWT_SECRET:?define JWT_SECRET en .env (mín. 16 chars)}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:-}
      DATABASE_URL: postgresql://${POSTGRES_USER:-nvcore}:${POSTGRES_PASSWORD:-nvcore}@db:5432/${POSTGRES_DB:-nvcore}?schema=public
      REDIS_URL: redis://redis:6379
      # Admin inicial OPCIONAL: si defines NV_ADMIN_EMAIL + NV_ADMIN_PASSWORD en
      # tu .env, ese usuario se crea al arrancar como Owner de todo. Sin ellos no
      # se siembra ningún admin (nunca uses credenciales por defecto conocidas).
      NV_ADMIN_EMAIL: ${NV_ADMIN_EMAIL:-}
      NV_ADMIN_PASSWORD: ${NV_ADMIN_PASSWORD:-}
      NV_ADMIN_NAME: ${NV_ADMIN_NAME:-}
      # Claves opcionales (IA, Meta, Cloudinary…) se toman del .env de la raíz.
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
      GEMINI_API_KEY: ${GEMINI_API_KEY:-}
      FB_PAGE_ID: ${FB_PAGE_ID:-}
      FB_PAGE_TOKEN: ${FB_PAGE_TOKEN:-}
      IG_BUSINESS_ID: ${IG_BUSINESS_ID:-}
      IG_ACCESS_TOKEN: ${IG_ACCESS_TOKEN:-}
      CLOUDINARY_URL: ${CLOUDINARY_URL:-}
      APP_URL: ${APP_URL:-http://localhost:3000}
    ports:
      - "4000:4000"
    volumes:
      # Persiste la sesión de WhatsApp (Baileys) entre reinicios.
      - nvcore-wa:/app/apps/api/data
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy

  web:
    build:
      context: .
      dockerfile: apps/web/Dockerfile
      args:
        # Inlined at build time — must be reachable from the browser.
        VITE_API_URL: ${VITE_API_URL:-http://localhost:4000}
    # Nginx serves the static SPA on port 80 inside the container.
    ports:
      - "3000:80"
    depends_on:
      - api

volumes:
  nvcore-db:
  nvcore-wa:
