# GamePanel — deployment from pre-built images.
#
# Unlike docker-compose.yml (which builds from source), every service here
# references a published image. That makes the stack deployable from a control
# panel that only writes a compose file plus an .env — WebPanel's "Custom
# Compose" screen, Portainer stacks, or a bare `docker compose up -d` on a
# server that has no checkout of this repository.
#
# Images are published by .github/workflows/ci.yml on every `v*` tag.
#
#   REGISTRY=gits.hibna.com.tr/hibna TAG=v0.1.0 docker compose \
#     -f docker-compose.panel.yml up -d
#
# Two files must exist on the host before the first start:
#   /etc/gamepanel/daemon-config.yml   — node_token must match DAEMON_TOKEN
#   /var/lib/gamepanel/{servers,backups}
#
# Serves plain HTTP on ${HOST_PORT}. Put a reverse proxy in front of it for TLS
# and a domain; WebPanel does this for you when you install with a domain.

services:
  # --- PostgreSQL ---
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${DB_USER:-gamepanel}
      POSTGRES_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD}
      POSTGRES_DB: ${DB_NAME:-gamepanel}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    expose:
      - "5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-gamepanel}"]
      interval: 10s
      timeout: 5s
      retries: 5

  # --- Redis (rate limiting, session cache) ---
  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:?set REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    expose:
      - "6379"
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # --- Schema migration + seed (runs to completion, then exits) ---
  #
  # A service that exits is not a failure here: `docker compose up --wait` —
  # what WebPanel runs — treats a `service_completed_successfully` dependency
  # correctly and reports the stack as healthy once api and web are up.
  migrate:
    image: ${REGISTRY:?set REGISTRY}/gamepanel-migrate:${TAG:?set TAG}
    restart: "no"
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql://${DB_USER:-gamepanel}:${DB_PASSWORD}@postgres:5432/${DB_NAME:-gamepanel}

  # --- API ---
  api:
    image: ${REGISTRY}/gamepanel-api:${TAG}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      migrate:
        condition: service_completed_successfully
    environment:
      NODE_ENV: production
      DATABASE_URL: postgresql://${DB_USER:-gamepanel}:${DB_PASSWORD}@postgres:5432/${DB_NAME:-gamepanel}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
      PORT: 3000
      HOST: 0.0.0.0
      JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET}
      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET:?set JWT_REFRESH_SECRET}
      # Must match the address browsers use, otherwise the SPA's requests are
      # rejected by CORS.
      CORS_ORIGIN: ${CORS_ORIGIN:-http://localhost:8096}
      RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-100}
      RATE_LIMIT_WINDOW_MS: ${RATE_LIMIT_WINDOW_MS:-60000}
    expose:
      - "3000"

  # --- Web (nginx + SPA, also reverse-proxies /api and /socket.io) ---
  #
  # The published port is named HOST_PORT on purpose: WebPanel picks the port
  # to reverse-proxy from that name. With two differently named *_PORT values
  # and no HOST_PORT it cannot tell which one to publish and refuses to bind a
  # domain.
  web:
    image: ${REGISTRY}/gamepanel-web:${TAG}
    restart: unless-stopped
    depends_on:
      - api
    ports:
      - "${HOST_PORT:-8096}:80"

  # --- Daemon ---
  #
  # Single-host setup: the API reaches the daemon over the compose network as
  # `daemon:50051`, so nothing needs to be published. For a *remote* node, run
  # this service on that machine instead and publish 50051 there.
  #
  # This container controls the host's Docker engine through the socket below.
  # That is root-equivalent access to every container on the machine, panel
  # containers included — prefer a dedicated node for the daemon.
  daemon:
    image: ${REGISTRY}/gamepanel-daemon:${TAG}
    restart: unless-stopped
    depends_on:
      - api
    environment:
      DAEMON_CONFIG: /etc/gamepanel/config.yml
      # Game containers are created through the host's Docker socket, so their
      # bind mounts are resolved by the *host*, not by this container.
      DAEMON_HOST_DATA_PATH: ${DAEMON_DATA_PATH:-/var/lib/gamepanel/servers}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${DAEMON_DATA_PATH:-/var/lib/gamepanel/servers}:/var/lib/gamepanel/servers
      - ${DAEMON_BACKUP_PATH:-/var/lib/gamepanel/backups}:/var/lib/gamepanel/backups
      # Absolute path: a panel-managed deployment has no checkout of this repo,
      # so the relative ./daemon-config.yml of docker-compose.yml is not there.
      - ${DAEMON_CONFIG_FILE:-/etc/gamepanel/daemon-config.yml}:/etc/gamepanel/config.yml:ro
    expose:
      - "50051"

volumes:
  postgres_data:
  redis_data: