docker-compose.yml

networks:
  tils-intranet:
    driver: bridge

services:
  postgres:
    image: postgres:16-alpine
    networks: [tils-intranet]
    environment:
      POSTGRES_DB: tils
      POSTGRES_USER: tils
      POSTGRES_PASSWORD: tils
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
      - ./schema:/docker-entrypoint-initdb.d
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U tils -d tils"]
      interval: 5s
      timeout: 5s
      retries: 5

  curios-manager:
    build:
      context: .
      dockerfile: curios-manager/Dockerfile
    networks: [tils-intranet]
    ports:
      - "50151:50151"
    healthcheck:
      test: ["CMD", "/grpc-health-probe", "-addr=:50151"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    environment:
      DATABASE_URL: postgres://tils:tils@postgres:5432/tils
      GRPC_PORT: "50151"
      NODE_KEY_PATH: /data/node.key
      NODE_PUBKEY_PATH: /data/node.pub
      NETWORK_GRPC: network-manager:50154
      REGISTER_ADDRESS: curios-manager:50151
      LCP_SERVER_URL: ${LCP_SERVER_URL:-}
      LSD_SERVER_URL: ${LSD_SERVER_URL:-}
      LSD_PUBLIC_URL: ${LSD_PUBLIC_URL:-}
      LCP_PROVIDER_URL: ${BFF_PUBLIC_URL:-http://localhost:3000}
    volumes:
      - node_identity:/data
    depends_on:
      postgres:
        condition: service_healthy

  users-manager:
    build:
      context: .
      dockerfile: users-manager/Dockerfile
    networks: [tils-intranet]
    ports:
      - "50152:50152"
    healthcheck:
      test: ["CMD", "/grpc-health-probe", "-addr=:50152"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    environment:
      DATABASE_URL: postgres://tils:tils@postgres:5432/tils
      GRPC_PORT: "50152"
      NODE_KEY_PATH: /data/node.key
      NODE_PUBKEY_PATH: /data/node.pub
      NETWORK_GRPC: network-manager:50154
      REGISTER_ADDRESS: users-manager:50152
    volumes:
      - node_identity:/data
    depends_on:
      postgres:
        condition: service_healthy

  network-manager:
    build:
      context: .
      dockerfile: network-manager/Dockerfile
    networks: [tils-intranet]
    ports:
      - "50153:50153"
      # Internal port 50154 is NOT exposed to the host — Docker-private only.
    healthcheck:
      test: ["CMD", "/grpc-health-probe", "-addr=:50154"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    environment:
      DATABASE_URL: postgres://tils:tils@postgres:5432/tils
      GRPC_PORT: "50153"
      INTERNAL_GRPC_PORT: "50154"
      NODE_KEY_PATH: /data/node.key
      NODE_PUBKEY_PATH: /data/node.pub
      NODE_CERT_PATH: /data/node.crt
    volumes:
      - node_identity:/data
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      postgres:
        condition: service_healthy

  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
    networks: [tils-intranet]
    ports:
      - "3000:3000"
    healthcheck:
      test: ["CMD", "wget", "-qO", "/dev/null", "http://localhost:3000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 15s
    environment:
      ORIGIN: ${ORIGIN:-http://localhost:3000}
      NETWORK_GRPC: network-manager:50154
      # CURIOS_GRPC / USERS_GRPC are optional overrides; without them the frontend
      # discovers services via network-manager's LocalDirectory (Lookup + WhoAmI).
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GOOGLE_REDIRECT_URI: ${GOOGLE_REDIRECT_URI:-http://localhost:3000/auth/callback/google}
      LCP_SERVER_URL: ${LCP_SERVER_URL:-}
      LSD_SERVER_URL: ${LSD_SERVER_URL:-}
      LSD_PUBLIC_URL: ${LSD_PUBLIC_URL:-}
    volumes:
      - node_identity:/data
    depends_on:
      network-manager:
        condition: service_healthy

  # ─── Readium LCP / LSD — opt-in: docker compose --profile lcp up ────────────
  # The lcp-server image must be built from source:
  #   https://github.com/readium/readium-lcp-server
  # Set LCP_SERVER_URL=http://lcp-server:10000 etc. in your .env to wire it in.

  lcp-server:
    image: ${LCP_SERVER_IMAGE:-readium/lcp-server:latest}
    profiles: [lcp]
    networks: [tils-intranet]
    ports:
      - "10000:10000"
    environment:
      LCPSERVER_DB_URL: postgres://tils:tils@postgres:5432/tils
      LCPSERVER_STORAGE_PATH: /content
      LCPSERVER_HOST: lcp-server
      LCPSERVER_PORT: "10000"
    volumes:
      - lcp_content:/content
    depends_on:
      postgres:
        condition: service_healthy

  lsd-server:
    image: ${LSD_SERVER_IMAGE:-readium/lsd-server:latest}
    profiles: [lcp]
    networks: [tils-intranet]
    ports:
      - "10001:10001"
    environment:
      LSDSERVER_DB_URL: postgres://tils:tils@postgres:5432/tils
      LSDSERVER_HOST: lsd-server
      LSDSERVER_PORT: "10001"
      LSDSERVER_PUBLIC_BASE_URL: ${LSD_PUBLIC_URL:-http://localhost:10001}
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  pgdata:
  node_identity:
  lcp_content: