services:
  nginx:
    build:
      context: .
      dockerfile: Dockerfile.nginx
    restart: "unless-stopped"
    ports:
      - "80:80"
      # Only open 443 once SSL certificates are mounted (e.g. via a certbot volume,
      # or a separate reverse proxy like Caddy/Traefik in front). See the infra phase of the plan.
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      - qrforge-app
    networks:
      - qrforge-network

  qrforge-app:
    build:
      context: .
      dockerfile: Dockerfile.fpm
    restart: "unless-stopped"
    environment:
      TYPE: "docker"
      QRCODE_GENERATOR: "${QRCODE_GENERATOR:-internal-chillerlan.qrcode}"
      BASE_URL: "${BASE_URL:?set BASE_URL in .env, e.g. https://qr.ensembia.com}"
      DATABASE_HOST: "qrforge-db"
      DATABASE_PORT: "3306"
      DATABASE_NAME: "${DATABASE_NAME:-qrcode}"
      DATABASE_USER: "${DATABASE_USER:-qrcode}"
      DATABASE_PASSWORD: "${DATABASE_PASSWORD:?set DATABASE_PASSWORD in .env}"
      DATABASE_PREFIX: "${DATABASE_PREFIX:-}"
      DATABASE_CHARSET: "${DATABASE_CHARSET:-utf8}"
      ALLOW_SELF_REGISTRATION: "${ALLOW_SELF_REGISTRATION:-false}"
      MAIL_HOST: "${MAIL_HOST:-}"
      MAIL_PORT: "${MAIL_PORT:-587}"
      MAIL_ENCRYPTION: "${MAIL_ENCRYPTION:-tls}"
      MAIL_SMTP_AUTH: "${MAIL_SMTP_AUTH:-true}"
      MAIL_USERNAME: "${MAIL_USERNAME:-}"
      MAIL_PASSWORD: "${MAIL_PASSWORD:-}"
      MAIL_FROM_ADDRESS: "${MAIL_FROM_ADDRESS:-noreply@example.com}"
      MAIL_FROM_NAME: "${MAIL_FROM_NAME:-QRForge}"
    depends_on:
      qrforge-db:
        condition: service_healthy
    volumes:
      - ./data/qrcode-storage:/var/www/qrcode-storage
    networks:
      - qrforge-network

  qrforge-db:
    image: "mysql:8.0"
    restart: "unless-stopped"
    volumes:
      - ./data/mysql:/var/lib/mysql
      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
    environment:
      MYSQL_ROOT_PASSWORD: "${MYSQL_ROOT_PASSWORD:?set MYSQL_ROOT_PASSWORD in .env}"
      MYSQL_DATABASE: "${DATABASE_NAME:-qrcode}"
      MYSQL_USER: "${DATABASE_USER:-qrcode}"
      MYSQL_PASSWORD: "${DATABASE_PASSWORD:?set DATABASE_PASSWORD in .env}"
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-p${MYSQL_ROOT_PASSWORD}"]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - qrforge-network

networks:
  qrforge-network:
    driver: bridge