# Kunden-Produktion – nur vorgebaute Images (kein build:)
# Image-Pfad: git.hexahost.dev/smueller/eikona-autoinstall-dist
# Version: IMAGE_TAG in .env (z. B. 1.0.0 oder latest)

x-backend-image: &backend_image
  git.hexahost.dev/smueller/eikona-autoinstall-dist/api:${IMAGE_TAG:-latest}

services:
  api:
    image: *backend_image
    container_name: eikona_api_prod
    network_mode: host
    command: ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
    environment: &backend_env
      APP_ENV: production
      DATABASE_URL: ${DATABASE_URL:-postgresql+psycopg://eikona:eikona@127.0.0.1:5432/eikona}
      REDIS_URL: redis://127.0.0.1:6379/0
      CELERY_BROKER_URL: redis://127.0.0.1:6379/0
      CELERY_RESULT_BACKEND: redis://127.0.0.1:6379/1
      AUTH_JWT_SECRET: ${AUTH_JWT_SECRET}
      AUTH_BOOTSTRAP_ADMIN_USERNAME: ${AUTH_BOOTSTRAP_ADMIN_USERNAME:-admin}
      AUTH_BOOTSTRAP_ADMIN_PASSWORD: ${AUTH_BOOTSTRAP_ADMIN_PASSWORD}
      PROXMOX_DEFAULT_ROOT_PASSWORD: ${PROXMOX_DEFAULT_ROOT_PASSWORD}
      WORKER_MAX_PARALLEL_DEPLOYMENTS: ${WORKER_MAX_PARALLEL_DEPLOYMENTS:-4}
      DEPLOY_SERVER_URL: ${DEPLOY_SERVER_URL}
      DEPLOY_SSH_KEY_PATH: /data/ssh/deploy_id_ed25519
      ISO_STORAGE_PATH: /data/isos
      ISO_PVE_VERSION: ${ISO_PVE_VERSION:-9.2-1}
      ISO_PVE_DOWNLOAD_URL: ${ISO_PVE_DOWNLOAD_URL:-}
      ISO_SSH_PUBLIC_KEY_PATH: /data/ssh/deploy_id_ed25519.pub
      CORS_ORIGINS: ${CORS_ORIGINS:-'["http://127.0.0.1"]'}
      CLEANUP_ENABLED: ${CLEANUP_ENABLED:-true}
      CLEANUP_INTERVAL_HOURS: ${CLEANUP_INTERVAL_HOURS:-24}
      CLEANUP_WORK_RETENTION_HOURS: ${CLEANUP_WORK_RETENTION_HOURS:-24}
      CLEANUP_ARTIFACT_RETENTION_DAYS: ${CLEANUP_ARTIFACT_RETENTION_DAYS:-7}
      CLEANUP_KEEP_LATEST_ARTIFACTS: ${CLEANUP_KEEP_LATEST_ARTIFACTS:-2}
      CLEANUP_REMOVE_SOURCE_CACHE: ${CLEANUP_REMOVE_SOURCE_CACHE:-false}
      # Lizenz: nur KEY vom Kunden – Rest fest im Image/Compose (nicht per .env abschaltbar)
      LICENSE_ENFORCE: "true"
      LICENSE_KEY: ${LICENSE_KEY}
      LICENSEGATE_API_URL: https://license-api.hexaho.st
      LICENSEGATE_USER_ID: "1"
      LICENSE_SCOPE: eikona-install
      LICENSE_USE_CHALLENGE: "true"
      LICENSE_CACHE_PATH: /data/license/verification-cache.json
      LICENSE_CACHE_GRACE_HOURS: "72"
    volumes:
      - /opt/docker/eikona/isos:/data/isos
      - /opt/docker/eikona/ssh:/data/ssh:ro
      - /opt/docker/eikona/license:/data/license
    depends_on:
      redis:
        condition: service_started
      db:
        condition: service_started

  worker:
    image: *backend_image
    container_name: eikona_worker_prod
    network_mode: host
    command: ["celery", "-A", "app.worker.celery_app", "worker", "--loglevel=info"]
    environment:
      <<: *backend_env
    volumes:
      - /opt/docker/eikona/isos:/data/isos
      - /opt/docker/eikona/ssh:/data/ssh:ro
      - /opt/docker/eikona/license:/data/license
    depends_on:
      redis:
        condition: service_started
      db:
        condition: service_started
      api:
        condition: service_started

  beat:
    image: *backend_image
    container_name: eikona_beat_prod
    network_mode: host
    command: ["celery", "-A", "app.worker.celery_app", "beat", "--loglevel=info"]
    environment:
      <<: *backend_env
    volumes:
      - /opt/docker/eikona/isos:/data/isos
      - /opt/docker/eikona/license:/data/license
    depends_on:
      redis:
        condition: service_started
      db:
        condition: service_started
      worker:
        condition: service_started

  redis:
    image: redis:7-alpine
    container_name: eikona_redis_prod
    network_mode: host

  db:
    image: postgres:16-alpine
    container_name: eikona_db_prod
    network_mode: host
    environment:
      POSTGRES_DB: eikona
      POSTGRES_USER: eikona
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-eikona}
    volumes:
      - /opt/docker/eikona/postgres:/var/lib/postgresql/data

  ui:
    image: git.hexahost.dev/smueller/eikona-autoinstall-dist/ui:${IMAGE_TAG:-latest}
    container_name: eikona_ui_prod
    network_mode: host
    depends_on:
      api:
        condition: service_started