services:
  # Production service
  mawidi-prod:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-https://api.mawidi.com}
        - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-https://mawidi.com}
        - NEXT_PUBLIC_WHATSAPP_NUMBER=${NEXT_PUBLIC_WHATSAPP_NUMBER:-+447450018521}
        - NEXT_PUBLIC_GA_ID=${NEXT_PUBLIC_GA_ID}
        - NEXT_PUBLIC_STRIPE_PUBLIC_KEY=${NEXT_PUBLIC_STRIPE_PUBLIC_KEY}
        - NEXT_PUBLIC_POSTHOG_KEY=${NEXT_PUBLIC_POSTHOG_KEY}
        - NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}
        - NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}
        - NEXT_PUBLIC_RECAPTCHA_SITE_KEY=${NEXT_PUBLIC_RECAPTCHA_SITE_KEY}
        - NEXT_PUBLIC_ELEVENLABS_AGENT_ID=${NEXT_PUBLIC_ELEVENLABS_AGENT_ID}
        - NEXT_PUBLIC_PRIVACY_EMAIL=${NEXT_PUBLIC_PRIVACY_EMAIL:-privacy@mawidi.com}
        - NEXT_PUBLIC_SUPPORT_EMAIL=${NEXT_PUBLIC_SUPPORT_EMAIL:-support@mawidi.com}
    image: mawidi-site:latest
    container_name: mawidi-prod
    restart: unless-stopped
    ports:
      - "9000:9000"
    extra_hosts:
      # Allow container to connect to host machine services (e.g., external Supabase)
      - "host.docker.internal:host-gateway"
    environment:
      - NODE_ENV=production
      - PORT=9000
      - HOSTNAME=0.0.0.0
      - NEXT_TELEMETRY_DISABLED=1
      # Auth environment variables
      - NEXTAUTH_URL=${NEXTAUTH_URL:-https://mawidi.com}
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      # Database connection
      - DATABASE_URL=${DATABASE_URL:-postgresql://${DB_USER:-mawidi}:${DB_PASSWORD:-mawidi_db_pass_2025}@postgres:5432/${DB_NAME:-mawidi_production}}
      # Redis connection
      - REDIS_URL=${REDIS_URL:-redis://:${REDIS_PASSWORD:-mawidi_redis_pass_2025}@redis:6379}
      # Upstash Redis (alternative to self-hosted)
      - UPSTASH_REDIS_REST_URL=${UPSTASH_REDIS_REST_URL}
      - UPSTASH_REDIS_REST_TOKEN=${UPSTASH_REDIS_REST_TOKEN}
      # Email for privacy policy
      - NEXT_PUBLIC_PRIVACY_EMAIL=${NEXT_PUBLIC_PRIVACY_EMAIL:-privacy@mawidi.com}
      - NEXT_PUBLIC_SUPPORT_EMAIL=${NEXT_PUBLIC_SUPPORT_EMAIL:-support@mawidi.com}
      # Google Analytics ID for cookie consent
      - NEXT_PUBLIC_GA_ID=${NEXT_PUBLIC_GA_ID}
      # Supabase configuration
      # IMPORTANT: For production, use external Supabase (cloud or self-hosted)
      # localhost/127.0.0.1 won't work inside Docker containers
      # Example: https://xxxxx.supabase.co or http://host.docker.internal:54321
      - NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}
      - NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}
      - SUPABASE_SERVICE_ROLE_KEY=${SUPABASE_SERVICE_ROLE_KEY}
      # reCAPTCHA configuration
      - NEXT_PUBLIC_RECAPTCHA_SITE_KEY=${NEXT_PUBLIC_RECAPTCHA_SITE_KEY}
      - RECAPTCHA_SECRET_KEY=${RECAPTCHA_SECRET_KEY}
      - RECAPTCHA_SCORE_THRESHOLD=${RECAPTCHA_SCORE_THRESHOLD:-0.5}
      # Stripe configuration
      - NEXT_PUBLIC_STRIPE_PUBLIC_KEY=${NEXT_PUBLIC_STRIPE_PUBLIC_KEY}
      - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY}
      - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET}
      # n8n Webhook configuration (for demo booking automation)
      - N8N_WEBHOOK_URL=${N8N_WEBHOOK_URL}
      - N8N_WEBHOOK_AUTH_TOKEN=${N8N_WEBHOOK_AUTH_TOKEN}
      - N8N_WEBHOOK_API_KEY=${N8N_WEBHOOK_API_KEY}
      # SMTP configuration for email sending (production SMTP server)
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT}
      - SMTP_SECURE=${SMTP_SECURE}
      - SMTP_USER=${SMTP_USER}
      - SMTP_PASS=${SMTP_PASS}
      - SMTP_FROM=${SMTP_FROM:-noreply@mawidi.com}
      # ElevenLabs Voice Agent configuration
      - ELEVENLABS_API_KEY=${ELEVENLABS_API_KEY}
      - NEXT_PUBLIC_ELEVENLABS_AGENT_ID=${NEXT_PUBLIC_ELEVENLABS_AGENT_ID}
      # Clerk auth
      - NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=${NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY}
      - CLERK_SECRET_KEY=${CLERK_SECRET_KEY}
      - NEXT_PUBLIC_CLERK_SIGN_IN_URL=${NEXT_PUBLIC_CLERK_SIGN_IN_URL}
      - NEXT_PUBLIC_CLERK_SIGN_UP_URL=${NEXT_PUBLIC_CLERK_SIGN_UP_URL}
      - CLERK_WEBHOOK_SECRET=${CLERK_WEBHOOK_SECRET}
      - CLERK_ISSUER_URL=${CLERK_ISSUER_URL}
      - NEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL=${NEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL}
      - NEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL=${NEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL}
      - NEXT_PUBLIC_CLERK_AFTER_SIGN_OUT_URL=${NEXT_PUBLIC_CLERK_AFTER_SIGN_OUT_URL}
      # Convex
      - NEXT_PUBLIC_CONVEX_URL=${NEXT_PUBLIC_CONVEX_URL}
      - CONVEX_URL=${CONVEX_URL}
      - CONVEX_DEPLOYMENT=${CONVEX_DEPLOYMENT}
      # Staff Dashboard - All authentication handled by NEXTAUTH_SECRET above
      # Access at: http://localhost:9000/staff/login (username/password)
      # Create first admin with: docker exec mawidi-prod npx tsx scripts/create-super-admin.ts
    volumes:
      # Mount for persistent data
      - ./data:/app/data
    networks:
      - mawidi-network
    # No depends_on - infrastructure runs independently
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:9000/ar"]
      interval: 30s
      timeout: 15s
      retries: 3
      start_period: 60s
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          cpus: '1'
          memory: 1G
    profiles:
      - production

  # Development service
  mawidi-dev:
    build:
      context: .
      dockerfile: Dockerfile.dev
    image: mawidi-site:dev
    container_name: mawidi-dev
    restart: unless-stopped
    ports:
      - "9000:9000"
    extra_hosts:
      # Allow container to connect to host machine services (e.g., Supabase)
      - "host.docker.internal:host-gateway"
    environment:
      - NODE_ENV=development
      - PORT=9000
      - HOSTNAME=0.0.0.0
      - NEXT_TELEMETRY_DISABLED=1
      - WATCHPACK_POLLING=true
      - CHOKIDAR_USEPOLLING=true
      - FAST_REFRESH=true
      - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-http://localhost:9000}
      - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:9000}
      - NEXT_PUBLIC_WHATSAPP_NUMBER=${NEXT_PUBLIC_WHATSAPP_NUMBER:-+447450018521}
      # Auth environment variables
      - NEXTAUTH_URL=${NEXTAUTH_URL:-http://localhost:9000}
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      # Clerk auth
      - NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=${NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY}
      - CLERK_SECRET_KEY=${CLERK_SECRET_KEY}
      - NEXT_PUBLIC_CLERK_SIGN_IN_URL=${NEXT_PUBLIC_CLERK_SIGN_IN_URL}
      - NEXT_PUBLIC_CLERK_SIGN_UP_URL=${NEXT_PUBLIC_CLERK_SIGN_UP_URL}
      - CLERK_WEBHOOK_SECRET=${CLERK_WEBHOOK_SECRET}
      - CLERK_ISSUER_URL=${CLERK_ISSUER_URL}
      - NEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL=${NEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL}
      - NEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL=${NEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL}
      - NEXT_PUBLIC_CLERK_AFTER_SIGN_OUT_URL=${NEXT_PUBLIC_CLERK_AFTER_SIGN_OUT_URL}
      # Convex
      - NEXT_PUBLIC_CONVEX_URL=${NEXT_PUBLIC_CONVEX_URL}
      - CONVEX_URL=${CONVEX_URL}
      - CONVEX_DEPLOYMENT=${CONVEX_DEPLOYMENT}
      # Database connection - Use host network names for Docker
      - DATABASE_URL=${DATABASE_URL:-postgresql://mawidi:mawidi_db_pass_2025@mawidi-postgres:5432/mawidi_production}
      # Redis connection - Hardcoded for Docker (ignore .env localhost value)
      - REDIS_URL=redis://:changeme_local_dev_only@mawidi-redis:6379
      # Upstash Redis (alternative to self-hosted)
      - UPSTASH_REDIS_REST_URL=${UPSTASH_REDIS_REST_URL}
      - UPSTASH_REDIS_REST_TOKEN=${UPSTASH_REDIS_REST_TOKEN}
      # Supabase configuration
      # For local development with host Supabase, use host.docker.internal
      # Or use external Supabase cloud instance
      - NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL:-http://host.docker.internal:54321}
      - NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}
      - SUPABASE_SERVICE_ROLE_KEY=${SUPABASE_SERVICE_ROLE_KEY}
      # reCAPTCHA configuration
      - NEXT_PUBLIC_RECAPTCHA_SITE_KEY=${NEXT_PUBLIC_RECAPTCHA_SITE_KEY}
      - RECAPTCHA_SECRET_KEY=${RECAPTCHA_SECRET_KEY}
      - RECAPTCHA_SCORE_THRESHOLD=${RECAPTCHA_SCORE_THRESHOLD:-0.5}
      # Stripe configuration
      - NEXT_PUBLIC_STRIPE_PUBLIC_KEY=${NEXT_PUBLIC_STRIPE_PUBLIC_KEY}
      - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY}
      - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET}
      # n8n Webhook configuration (for demo booking automation)
      - N8N_WEBHOOK_URL=${N8N_WEBHOOK_URL}
      - N8N_WEBHOOK_AUTH_TOKEN=${N8N_WEBHOOK_AUTH_TOKEN}
      - N8N_WEBHOOK_API_KEY=${N8N_WEBHOOK_API_KEY}
      # SMTP configuration for email sending (MailHog for dev - hardcoded to use container name)
      - SMTP_HOST=mawidi-mailhog
      - SMTP_PORT=1025
      - SMTP_SECURE=false
      - SMTP_USER=
      - SMTP_PASS=
      - SMTP_FROM=noreply@mawidi.local
      # ElevenLabs Voice Agent configuration
      - ELEVENLABS_API_KEY=${ELEVENLABS_API_KEY}
      - NEXT_PUBLIC_ELEVENLABS_AGENT_ID=${NEXT_PUBLIC_ELEVENLABS_AGENT_ID}
      # Google API keys
      - GOOGLE_CLOUD_API_KEY=${GOOGLE_CLOUD_API_KEY}
    volumes:
      # Mount source code for hot-reload
      - ./app:/app/app
      - ./components:/app/components
      - ./lib:/app/lib
      - ./hooks:/app/hooks
      - ./types:/app/types
      - ./content:/app/content
      - ./public:/app/public
      - ./prisma:/app/prisma
      - ./supabase:/app/supabase
      - ./scripts:/app/scripts
      - ./next.config.mjs:/app/next.config.mjs
      - ./tsconfig.json:/app/tsconfig.json
      - ./tailwind.config.ts:/app/tailwind.config.ts
      - ./postcss.config.mjs:/app/postcss.config.mjs
      - ./middleware.ts:/app/middleware.ts
      - ./middleware-security.ts:/app/middleware-security.ts
      - ./package.json:/app/package.json
      - ./package-lock.json:/app/package-lock.json
      # Persist node_modules
      - node_modules:/app/node_modules
      # Persist Next.js cache
      - next_cache:/app/.next
      # Persist data directory (OTPs, etc.)
      - ./data:/app/data
    networks:
      - mawidi-network
    # Health check with longer timeout for development (compilation can take time)
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:9000/ar || wget --no-verbose --tries=1 --spider http://localhost:9000/api/health || exit 0"]
      interval: 60s
      timeout: 30s
      retries: 3
      start_period: 120s
    profiles:
      - development

  # Nginx reverse proxy (optional, for production)
  nginx:
    image: nginx:alpine
    container_name: mawidi-nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/sites:/etc/nginx/sites-enabled:ro
      - ./ssl:/etc/nginx/ssl:ro
      - ./nginx/cache:/var/cache/nginx
    depends_on:
      - mawidi-prod
    networks:
      - mawidi-network
    profiles:
      - production


networks:
  mawidi-network:
    external: true
    name: mawidi-network  # References network created by docker-compose.infra.yml

volumes:
  # Application-only volumes (no infrastructure volumes here)
  node_modules:
    name: mawidi-node-modules
  next_cache:
    name: mawidi-next-cache
  # postgres_data and redis_data are managed by docker-compose.infra.yml
