services:
  monitoring-app:
    image: ghcr.io/bipprojectbali/monitoring-app:stg-latest
    container_name: monitoring-app-stg
    restart: unless-stopped
    environment:
      # App
      - PORT=${PORT:-3000}
      - NODE_ENV=${NODE_ENV:-production}
      - BUN_PUBLIC_BASE_URL=${BUN_PUBLIC_BASE_URL}
      # Database
      - DATABASE_URL=${DATABASE_URL}
      - DIRECT_URL=${DIRECT_URL}
      # Google OAuth
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      # Super Admin
      - SUPER_ADMIN_EMAIL=${SUPER_ADMIN_EMAIL}
      # API Key
      - API_KEY=${API_KEY}
      # MinIO (object storage)
      - MINIO_ENDPOINT=${MINIO_ENDPOINT}
      - MINIO_PORT=${MINIO_PORT:-443}
      - MINIO_USE_SSL=${MINIO_USE_SSL:-true}
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY}
      - MINIO_BUCKET=${MINIO_BUCKET}
      - MINIO_UPLOAD_DIR=${MINIO_UPLOAD_DIR:-bug-reports}
      # Redis (optional — app logs feature)
      - REDIS_URL=${REDIS_URL:-}
    networks:
      - public-net
      - postgres-net-stg
    depends_on:
      migrate:
        condition: service_completed_successfully
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          memory: 512M
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=public-net"
      - "traefik.http.routers.monitoring-app.rule=Host(`monitoring-stg.wibudev.com`)"
      - "traefik.http.routers.monitoring-app.entrypoints=websecure"
      - "traefik.http.routers.monitoring-app.tls=true"
      - "traefik.http.routers.monitoring-app.tls.certresolver=letsencrypt"
      - "traefik.http.services.monitoring-app.loadbalancer.server.port=3000"

  migrate:
    image: ghcr.io/bipprojectbali/monitoring-app:stg-latest
    container_name: monitoring-app-stg-migrate
    restart: "no"
    # `migrate deploy` only applies existing migrations from prisma/migrations/.
    # Safer than `migrate dev --name auto` which auto-generates new migrations
    # from schema diff (risk of drift in production).
    # Seed runs only if SEED_ON_DEPLOY=true (idempotent — wipe-and-reseed by
    # design; recommend leaving false for production with real customer data).
    entrypoint: ["sh", "-c", "bunx prisma migrate deploy && if [ \"$$SEED_ON_DEPLOY\" = \"true\" ]; then bun prisma/seed.ts; fi"]
    environment:
      - DATABASE_URL=${DIRECT_URL}
      - SEED_ON_DEPLOY=${SEED_ON_DEPLOY:-false}
    networks:
      - postgres-net-stg

networks:
  public-net:
    external: true
  postgres-net-stg:
    external: true