services:
  pocketbase:
    build:
      context: .
      dockerfile: docker/pocketbase/Dockerfile
    container_name: pb-auth-proxy-pocketbase
    ports:
      - "${POCKETBASE_PUBLISH_PORT:-8090}:8090"
    volumes:
      - pocketbase_data:/pb/pb_data
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8090/api/health"]
      interval: 5s
      timeout: 3s
      retries: 20

  backend:
    image: nginx:1.27-alpine
    container_name: pb-auth-proxy-backend
    volumes:
      - ./docker/demo-backend/index.html:/usr/share/nginx/html/index.html:ro
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1/"]
      interval: 5s
      timeout: 3s
      retries: 20

  auth-proxy:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: pb-auth-proxy-app
    depends_on:
      pocketbase:
        condition: service_healthy
      backend:
        condition: service_healthy
    environment:
      LISTEN_PORT: ${LISTEN_PORT:-8080}
      TARGET_URL: ${TARGET_URL:-http://backend:80}
      SESSION_SECRET: ${SESSION_SECRET:-local-dev-session-secret-change-me}
      XSRF_SECRET_KEY: ${XSRF_SECRET_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=}
      POCKETBASE_URL: ${POCKETBASE_URL:-http://pocketbase:8090}
      POCKETBASE_COLLECTION: ${POCKETBASE_COLLECTION:-proxy_users}
      POCKETBASE_IDENTITY_FIELD: ${POCKETBASE_IDENTITY_FIELD:-username}
      POCKETBASE_SUPERUSER_EMAIL: ${POCKETBASE_SUPERUSER_EMAIL:-admin@example.com}
      POCKETBASE_SUPERUSER_PASSWORD: ${POCKETBASE_SUPERUSER_PASSWORD:-change-me-now}
      POCKETBASE_EMAIL_DOMAIN: ${POCKETBASE_EMAIL_DOMAIN:-pb-auth.local}
      FRONTEND_TYPE: ${FRONTEND_TYPE:-js}
      PROTECT_FRONTEND: ${PROTECT_FRONTEND:-true}
      PROTECT_API: ${PROTECT_API:-true}
      REGISTER: ${REGISTER:-true}
      PASSWORD_POLICY: ${PASSWORD_POLICY:-standard}
      MAX_LOGIN_ATTEMPTS: ${MAX_LOGIN_ATTEMPTS:-5}
      LOCKOUT_DURATION_MINUTES: ${LOCKOUT_DURATION_MINUTES:-10}
      USER_CREATION_RATE_LIMIT_MAX_REQUESTS: ${USER_CREATION_RATE_LIMIT_MAX_REQUESTS:-5}
      USER_CREATION_RATE_LIMIT_WINDOW_SECONDS: ${USER_CREATION_RATE_LIMIT_WINDOW_SECONDS:-3600}
      TOKEN_DURATION_HOURS: ${TOKEN_DURATION_HOURS:-24}
      ACCESS_TOKEN_DURATION_MINUTES: ${ACCESS_TOKEN_DURATION_MINUTES:-15}
      REFRESH_TOKEN_DURATION_DAYS: ${REFRESH_TOKEN_DURATION_DAYS:-7}
    ports:
      - "${AUTH_PROXY_PUBLISH_PORT:-8080}:8080"

volumes:
  pocketbase_data: