services:
  api:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
      target: production
    environment:
      NODE_ENV: production
      DB_HOST: mariadb
      DB_PORT: 3306
      DB_USER: familysync
      DB_PASSWORD: ${DB_PASSWORD}
      DB_NAME: familysync
      OIDC_AUTH_SECRET: ${OIDC_AUTH_SECRET:-placeholder_change_me}
      OIDC_ISSUER: ${OIDC_ISSUER:-}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID:-familysync}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-}
      OIDC_AUTH_EXTERNAL_URL: ${OIDC_AUTH_EXTERNAL_URL:-}
      # Constrain requested scopes — @hono/oidc-auth requests ALL of the IdP's
      # scopes_supported when OIDC_SCOPES is empty (Authelia then rejects with
      # invalid_scope). offline_access is required for refresh-token session
      # persistence (D-12/AUTH-02) and must also be allowed on the Authelia client.
      OIDC_SCOPES: ${OIDC_SCOPES:-openid profile email offline_access}
      APP_PASSWORD_ENCRYPTION_KEY: ${APP_PASSWORD_ENCRYPTION_KEY:-}
      # VAPID keys for Web Push notifications (Phase 5).
      # Generate with: npx web-push generate-vapid-keys --json
      # Private key must only live in the gitignored .env — never commit it.
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:-}
      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:-}
      VAPID_SUBJECT: ${VAPID_SUBJECT:-}
    depends_on:
      mariadb:
        condition: service_healthy
    ports:
      - '3000:3000'

  mariadb:
    image: mariadb:11
    environment:
      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      MARIADB_DATABASE: familysync
      MARIADB_USER: familysync
      MARIADB_PASSWORD: ${DB_PASSWORD}
    volumes:
      - mariadb_data:/var/lib/mysql
    healthcheck:
      test: ['CMD', 'healthcheck.sh', '--connect', '--innodb_initialized']
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    # Phase 1: present but unused; Phase 4 wires pub/sub for live list sync

volumes:
  mariadb_data: