# Runs the whole hub: Postgres, the API (port 4101) and the website (port 4100). Set AUTH_SECRET, and the public
# addresses when they aren't localhost (API_PUBLIC_URL, WEB_PUBLIC_URL):
#   AUTH_SECRET=$(openssl rand -base64 32) docker compose up -d
services:
  postgres:
    image: postgres:17
    environment:
      POSTGRES_USER: t5de
      POSTGRES_PASSWORD: t5de
      POSTGRES_DB: t5de_hub
    volumes: [postgres:/var/lib/postgresql/data]
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "t5de"]
      interval: 2s
      retries: 30

  api:
    build: { context: ., dockerfile: apps/api/Dockerfile }
    environment:
      DATABASE_URL: postgres://t5de:t5de@postgres:5432/t5de_hub
      AUTH_SECRET: ${AUTH_SECRET:?set AUTH_SECRET}
      # T5DE's proxies reach the API directly (sign-in and the WebSocket); the website reaches it through its own /api.
      API_URL: ${API_PUBLIC_URL:-http://localhost:4101}
      WEB_URL: ${WEB_PUBLIC_URL:-http://localhost:4100}
      # open, or closed (new accounts wait for a moderator's approval) until an admin changes it in the console.
      REGISTRATION: ${REGISTRATION:-open}
      # Ways to verify age (apps/api/src/index.ts): imvu, and didit with its keys.
      AGE_PROVIDERS: ${AGE_PROVIDERS:-imvu}
      DIDIT_API_KEY: ${DIDIT_API_KEY:-}
      DIDIT_WORKFLOW_ID: ${DIDIT_WORKFLOW_ID:-}
      DIDIT_WEBHOOK_SECRET: ${DIDIT_WEBHOOK_SECRET:-}
    ports: ["4101:4101"]
    depends_on:
      postgres: { condition: service_healthy }

  web:
    build: { context: ., dockerfile: apps/web/Dockerfile }
    environment:
      API_URL: http://api:4101
    ports: ["4100:4100"]
    depends_on: [api]

volumes:
  postgres: