services:
  postgres:
    image: postgres:17
    environment:
      POSTGRES_DB: entkube
      POSTGRES_USER: entkube
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:-changeme}"
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U entkube -d entkube"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s
    restart: unless-stopped

  entkube:
    build:
      context: .
      dockerfile: Dockerfile
    image: entkube:latest
    ports:
      - "8080:8080"
    volumes:
      - entkube-data:/app/Data
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      # --- Database ---
      DatabaseProvider: Postgres
      ConnectionStrings__DefaultConnection: "Host=postgres;Port=5432;Database=entkube;Username=entkube;Password=${POSTGRES_PASSWORD:-changeme}"

      # --- Vault encryption ---
      # Required. Generate with: openssl rand -base64 32
      Vault__RootKey: "REPLACE_WITH_BASE64_32_BYTE_KEY"

      # --- Auth ---
      # Set to false after the first admin account is created.
      Auth__AllowRegistration: "true"

      # --- Bootstrap ---
      # Optional. If set, this user is granted the Admin role on every startup
      # (no-op if already admin). Useful for recovering access.
      # Seed__AdminEmail: "admin@example.com"

      # --- Email / SMTP (optional) ---
      # Smtp__Host: "smtp.example.com"
      # Smtp__Username: "user"
      # Smtp__Password: "password"
      # Smtp__FromAddress: "alerts@entkube.io"
    restart: unless-stopped

volumes:
  # Named volumes are NOT removed by "docker compose down".
  # Data is only deleted if you explicitly run "docker compose down -v".
  postgres-data:
  entkube-data: