services:
  database:
    image: postgres:17-bookworm
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-apolon_licensing}
      POSTGRES_USER: ${POSTGRES_USER:-apolon_licensing}
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
    secrets:
      - postgres_password
    volumes:
      - licensing_database:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
      interval: 10s
      timeout: 5s
      retries: 10

  api:
    build:
      context: ..
      dockerfile: licensing_server/Dockerfile
    restart: unless-stopped
    depends_on:
      database:
        condition: service_healthy
    environment:
      LICENSING_DATABASE_URL_FILE: /run/secrets/licensing_database_url
      LICENSING_ENVIRONMENT: production
      LICENSING_SIGNING_KEY_ID: ${LICENSING_SIGNING_KEY_ID:?required}
      LICENSING_SIGNING_PRIVATE_KEY_PATH: /run/licensing-signing-key
      LICENSING_SERIAL_PEPPER_BASE64_FILE: /run/secrets/serial_pepper_base64
      LICENSING_FINGERPRINT_PEPPER_BASE64_FILE: /run/secrets/fingerprint_pepper_base64
      LICENSING_OIDC_ISSUER: ${LICENSING_OIDC_ISSUER:?required}
      LICENSING_OIDC_AUDIENCE: ${LICENSING_OIDC_AUDIENCE:?required}
      LICENSING_OIDC_JWKS_URL: ${LICENSING_OIDC_JWKS_URL:?required}
      LICENSING_OIDC_AUTHORIZATION_ENDPOINT: ${LICENSING_OIDC_AUTHORIZATION_ENDPOINT:?required}
      LICENSING_OIDC_TOKEN_ENDPOINT: ${LICENSING_OIDC_TOKEN_ENDPOINT:?required}
      LICENSING_OIDC_NATIVE_CLIENT_ID: ${LICENSING_OIDC_NATIVE_CLIENT_ID:?required}
      LICENSING_ALLOW_PRODUCTION_FILE_SIGNER: "true"
      LICENSING_STRIPE_WEBHOOK_SECRET_FILE: /run/secrets/stripe_webhook_secret
      LICENSING_STRIPE_SECRET_KEY_FILE: /run/secrets/stripe_secret_key
      LICENSING_STRIPE_COMMERCE_ENABLED: ${LICENSING_STRIPE_COMMERCE_ENABLED:-false}
      LICENSING_STRIPE_PRICE_SKU_MAP_JSON: ${LICENSING_STRIPE_PRICE_SKU_MAP_JSON:-{}}
      LICENSING_STRIPE_CHECKOUT_SUCCESS_URL: ${LICENSING_STRIPE_CHECKOUT_SUCCESS_URL:-}
      LICENSING_STRIPE_CHECKOUT_CANCEL_URL: ${LICENSING_STRIPE_CHECKOUT_CANCEL_URL:-}
      LICENSING_STRIPE_BILLING_PORTAL_RETURN_URL: ${LICENSING_STRIPE_BILLING_PORTAL_RETURN_URL:-}
      LICENSING_TRUSTED_PROXY_IPS: ${LICENSING_TRUSTED_PROXY_IPS:-127.0.0.1/32,::1/128}
    secrets:
      - licensing_database_url
      - serial_pepper_base64
      - fingerprint_pepper_base64
      - stripe_webhook_secret
      - stripe_secret_key
    volumes:
      - type: bind
        source: ${LICENSING_SIGNING_KEY_FILE:?required}
        target: /run/licensing-signing-key
        read_only: true
    expose:
      - "8080"

  subscription_worker:
    build:
      context: ..
      dockerfile: licensing_server/Dockerfile
    restart: unless-stopped
    depends_on:
      database:
        condition: service_healthy
    entrypoint: ["python", "-m", "licensing_server.cli", "outbox", "worker"]
    environment:
      LICENSING_DATABASE_URL_FILE: /run/secrets/licensing_database_url
      LICENSING_ENVIRONMENT: production
      LICENSING_STRIPE_SECRET_KEY_FILE: /run/secrets/stripe_secret_key
      LICENSING_STRIPE_PRICE_SKU_MAP_JSON: ${LICENSING_STRIPE_PRICE_SKU_MAP_JSON:-{}}
    secrets:
      - licensing_database_url
      - stripe_secret_key
    healthcheck:
      test: ["CMD", "python", "-m", "licensing_server.cli", "deployment", "doctor", "--component", "subscription_worker"]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3

  notification_worker:
    profiles: ["notifications"]
    build:
      context: ..
      dockerfile: licensing_server/Dockerfile
    restart: unless-stopped
    depends_on:
      database:
        condition: service_healthy
    entrypoint: ["python", "-m", "licensing_server.cli", "notifications", "worker"]
    environment:
      LICENSING_DATABASE_URL_FILE: /run/secrets/licensing_database_url
      LICENSING_ENVIRONMENT: production
      LICENSING_EMAIL_NOTIFICATIONS_ENABLED: "true"
      LICENSING_SMTP_HOST: ${LICENSING_SMTP_HOST:?required}
      LICENSING_SMTP_PORT: ${LICENSING_SMTP_PORT:-465}
      LICENSING_SMTP_TLS_MODE: ${LICENSING_SMTP_TLS_MODE:-implicit}
      LICENSING_SMTP_USERNAME: ${LICENSING_SMTP_USERNAME:?required}
      LICENSING_SMTP_PASSWORD_FILE: /run/secrets/smtp_password
      LICENSING_NOTIFICATION_PEPPER_BASE64_FILE: /run/secrets/notification_pepper_base64
      LICENSING_EMAIL_FROM_ADDRESS: ${LICENSING_EMAIL_FROM_ADDRESS:?required}
      LICENSING_ACCOUNT_PORTAL_URL: ${LICENSING_ACCOUNT_PORTAL_URL:?required}
    secrets:
      - licensing_database_url
      - smtp_password
      - notification_pepper_base64
    healthcheck:
      test: ["CMD", "python", "-m", "licensing_server.cli", "deployment", "doctor", "--component", "notification_worker"]
      interval: 30s
      timeout: 5s
      start_period: 20s
      retries: 3

volumes:
  licensing_database:

secrets:
  postgres_password:
    file: ${POSTGRES_PASSWORD_FILE:?required}
  licensing_database_url:
    file: ${LICENSING_DATABASE_URL_FILE:?required}
  serial_pepper_base64:
    file: ${LICENSING_SERIAL_PEPPER_BASE64_FILE:?required}
  fingerprint_pepper_base64:
    file: ${LICENSING_FINGERPRINT_PEPPER_BASE64_FILE:?required}
  stripe_webhook_secret:
    file: ${LICENSING_STRIPE_WEBHOOK_SECRET_FILE:?required}
  stripe_secret_key:
    file: ${LICENSING_STRIPE_SECRET_KEY_FILE:?required}
  smtp_password:
    file: ${LICENSING_SMTP_PASSWORD_FILE:-./secrets/smtp_password}
  notification_pepper_base64:
    file: ${LICENSING_NOTIFICATION_PEPPER_BASE64_FILE:-./secrets/notification_pepper_base64}
