name: stankin-international

services:
  db:
    image: postgres:16
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: stankin
    ports: ["5432:5432"]
    volumes:
      - dbdata:/var/lib/postgresql/data
      # схема + слой безопасности (RLS/триггеры/роли/шифрование) и роль приложения — при первой инициализации
      - ./db/schema.sql:/docker-entrypoint-initdb.d/01-schema.sql:ro
      - ./db/02-app-role.sql:/docker-entrypoint-initdb.d/02-app-role.sql:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d stankin"]
      interval: 5s
      timeout: 5s
      retries: 12

  # S3-РФ для документов (в проде — реальное хранилище в РФ)
  minio:
    image: minio/minio
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    ports: ["9000:9000", "9001:9001"]
    volumes: ["miniodata:/data"]

  minio-init:
    image: minio/mc
    depends_on: [minio]
    entrypoint: >
      /bin/sh -c "
      until mc alias set local http://minio:9000 minioadmin minioadmin; do echo 'wait minio'; sleep 2; done;
      mc mb -p local/stankin-docs || true;
      echo 'bucket ready'; exit 0;"

  # антивирус загрузок (clamd, протокол INSTREAM на 3310)
  clamav:
    image: clamav/clamav:stable
    restart: unless-stopped
    ports: ["3310:3310"]
    volumes: ["clamavdb:/var/lib/clamav"]   # кэш сигнатур, чтобы не качать каждый раз
    healthcheck:
      test: ["CMD-SHELL", "clamdcheck.sh || exit 1"]
      interval: 15s
      timeout: 10s
      retries: 20
      start_period: 180s                     # первый старт качает базы сигнатур (несколько минут)

  # просмотр писем в dev: UI на http://localhost:8025
  mailhog:
    image: mailhog/mailhog
    restart: unless-stopped
    ports: ["1025:1025", "8025:8025"]

  app:
    restart: unless-stopped
    build:
      context: .
      dockerfile: Dockerfile
    depends_on:
      db:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully
      clamav:
        condition: service_healthy
      mailhog:
        condition: service_started
    environment:
      DATABASE_URL: postgresql://app_user:app_pwd@db:5432/stankin
      JWT_SECRET: dev-secret-change-me
      JWT_TTL: 3600s
      PDN_ENC_KEY: dev-pdn-key
      TOKEN_PEPPER: dev-token-pepper
      FRONTEND_URL: http://localhost:5173
      MAIL_TRANSPORT: smtp
      MAIL_HOST: mailhog
      MAIL_PORT: "1025"
      MAIL_SECURE: "false"
      MAIL_FROM: "МГТУ СТАНКИН <no-reply@stankin.ru>"
      STORAGE_DRIVER: s3
      S3_ENDPOINT: http://minio:9000
      S3_BUCKET: stankin-docs
      S3_REGION: ru-central1
      S3_ACCESS_KEY: minioadmin
      S3_SECRET_KEY: minioadmin
      S3_FORCE_PATH_STYLE: "true"
      SCANNER_DRIVER: clamav
      CLAMAV_HOST: clamav
      CLAMAV_PORT: "3310"
    ports: ["3000:3000"]
    init: true
    healthcheck:
      test: ["CMD-SHELL", "node -e \"fetch('http://127.0.0.1:3000/api/v1/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\""]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

volumes:
  dbdata:
  miniodata:
  clamavdb: