services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: streaming
      POSTGRES_USER: streamuser
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./database/init.sql:/docker-entrypoint-initdb.d/init.sql
      - ./scripts:/scripts:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U streamuser -d streaming"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend

  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend

  ovenmediaengine:
    image: airensoft/ovenmediaengine:latest
    ports:
      - "1935:1935"           # RTMP
      - "9999:9999/udp"       # SRT
      # HLS/LLHLS now proxied through openresty (removed direct exposure)
      - "8081:8081"           # API (internal)
      # WebRTC Signaling (3333) now proxied through nginx
      - "3478:3478"           # STUN/TURN for NAT traversal
      - "10000-10009:10000-10009/udp" # WebRTC ICE Candidates
    volumes:
      - ./ovenmediaengine/Server.xml:/opt/ovenmediaengine/bin/origin_conf/Server.xml
      - ome_logs:/var/log/ovenmediaengine
    environment:
      OME_API_PORT: 8081
      OME_API_ACCESS_TOKEN: ${OME_API_TOKEN}
    networks:
      - backend
      - frontend

  drogon-backend:
    build: ./backend
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      DB_HOST: postgres
      DB_NAME: streaming
      DB_USER: streamuser
      DB_PASS: ${DB_PASSWORD}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_DB: 1
      REDIS_PASS: ${REDIS_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
      OME_API_URL: http://ovenmediaengine:8081
      OME_API_TOKEN: ${OME_API_TOKEN}
    volumes:
      - ./backend/config.json:/app/config.json
      - uploads:/app/uploads
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - backend

  chat-service:
    build: ./chat-service
    depends_on:
      redis:
        condition: service_healthy
      drogon-backend:
        condition: service_healthy
    environment:
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_DB: 1
      REDIS_PASS: ${REDIS_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
    volumes:
      - ./chat-service/config.json:/app/config.json
    healthcheck:
      test: ["CMD-SHELL", "curl -s http://localhost:8081/ > /dev/null 2>&1 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - backend

  nakama:
    build: ./nakama
    depends_on:
      postgres:
        condition: service_healthy
    entrypoint:
      - "/bin/sh"
      - "-c"
      - |
        set -e
        apt-get update >/dev/null 2>&1 && apt-get install -y postgresql-client >/dev/null 2>&1 || true
        PGPASSWORD=$DB_PASSWORD psql -h postgres -U streamuser -d postgres -tc "SELECT 1 FROM pg_database WHERE datname = 'nakama'" | grep -q 1 || PGPASSWORD=$DB_PASSWORD psql -h postgres -U streamuser -d postgres -c "CREATE DATABASE nakama"
        /nakama/nakama migrate up --database.address "streamuser:$DB_PASSWORD@postgres:5432/nakama?sslmode=disable"
        exec /nakama/nakama \
          --name realms-nakama \
          --database.address "streamuser:$DB_PASSWORD@postgres:5432/nakama?sslmode=disable" \
          --socket.server_key "$NAKAMA_SERVER_KEY" \
          --session.token_expiry_sec 86400 \
          --runtime.env "JWT_SECRET=$JWT_SECRET" \
          --console.username admin \
          --console.password "$NAKAMA_CONSOLE_PASSWORD" \
          --logger.level INFO
    environment:
      - JWT_SECRET=${JWT_SECRET}
      - NAKAMA_CONSOLE_PASSWORD=${NAKAMA_CONSOLE_PASSWORD}
      - NAKAMA_SERVER_KEY=${NAKAMA_SERVER_KEY}
      - DB_PASSWORD=${DB_PASSWORD}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:7350/healthcheck"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - backend
      - frontend

  openresty:
    build: ./openresty
    ports:
      - "80:80"
      - "443:443"
      - "8088:8088"           # HLS/LLHLS proxy with CORS
    depends_on:
      drogon-backend:
        condition: service_healthy
      chat-service:
        condition: service_healthy
      ovenmediaengine:
        condition: service_started
      redis:
        condition: service_healthy
      nakama:
        condition: service_started
    environment:
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_DB: 1
      REDIS_PASS: ${REDIS_PASSWORD}
      BACKEND_URL: http://drogon-backend:8080
      CHAT_URL: http://chat-service:8081
      OME_URL: http://ovenmediaengine:8081
      JWT_SECRET: ${JWT_SECRET}
    volumes:
      - ./openresty/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf
      - ./openresty/lua:/usr/local/openresty/nginx/lua
      - ./openresty/conf.d:/usr/local/openresty/nginx/conf/conf.d:ro
      - uploads:/app/uploads:ro  # Mount uploads volume to the same path
      - letsencrypt_data:/etc/letsencrypt:ro
      - certbot_webroot:/var/www/certbot:ro
    networks:
      - frontend
      - backend

  sveltekit:
    build:
      context: ./frontend
      args:
        VITE_NAKAMA_SERVER_KEY: ${NAKAMA_SERVER_KEY}
        VITE_NAKAMA_HOST: localhost
        VITE_NAKAMA_PORT: "80"
        VITE_NAKAMA_USE_SSL: "false"
    depends_on:
      openresty:
        condition: service_started
    environment:
      NODE_ENV: production
    networks:
      - frontend

  certbot:
    image: certbot/certbot:latest
    volumes:
      - letsencrypt_data:/etc/letsencrypt
      - certbot_webroot:/var/www/certbot
      - ./scripts/certbot-entrypoint.sh:/entrypoint.sh:ro
    entrypoint: ["/bin/sh", "/entrypoint.sh"]
    environment:
      - CERTBOT_EMAIL=${CERTBOT_EMAIL:-admin@example.com}
    networks:
      - backend
    restart: unless-stopped

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge

volumes:
  postgres_data:
  redis_data:
  ome_logs:
  uploads:  # Named volume for uploads
  letsencrypt_data:  # Let's Encrypt certificates
  certbot_webroot:   # ACME challenge webroot