services:
  db:
    image: postgres:16-alpine
    container_name: osint-board-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: osint_dev
      POSTGRES_USER: osint
      POSTGRES_PASSWORD: osint_secret
    ports:
      - "5433:5432"
    volumes:
      - osint_postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U osint -d osint_dev"]
      interval: 3s
      timeout: 3s
      retries: 10

  app:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: osint-board-app
    environment:
      NODE_ENV: development
      PORT: 8787
      DATABASE_URL: postgres://osint:osint_secret@db:5432/osint_dev
      CORS_ORIGIN: http://localhost:8787
      JWT_SECRET: ${JWT_SECRET:-osint-local-dev-secret}
      LEVEL_EDITING_ENABLED: "true"
      MAX_DOCUMENT_BYTES: 26214400
      OCR_ENABLED: "true"
      OCR_LANGUAGES: nor+eng
      OCR_TIMEOUT_MS: 20000
      MAX_OCR_BYTES: 15728640
      MAX_EXTRACTED_TEXT_CHARACTERS: 200000
      S3_ENDPOINT: http://minio:9000
      S3_REGION: us-east-1
      S3_ACCESS_KEY: gupi
      S3_SECRET_KEY: gupi_secret
      S3_BUCKET: gupi
      S3_FORCE_PATH_STYLE: "true"
    ports:
      - "8787:8787"
    depends_on:
      db:
        condition: service_healthy
      createbuckets:
        condition: service_completed_successfully
    # Run directly (not `npm start`, which forces NODE_ENV=production) so the
    # NODE_ENV=development above applies and dev conveniences like the admin-session
    # route are available.
    command: ["sh", "-c", "npm run migrate:up && npx tsx server/index.ts"]

  minio:
    image: minio/minio:latest
    container_name: osint-board-minio
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: gupi
      MINIO_ROOT_PASSWORD: gupi_secret
    ports:
      - "9000:9000"   # S3 API
      - "9001:9001"   # web console
    volumes:
      - osint_minio_data:/data

  # One-shot: wait for MinIO, then ensure the gupi bucket exists. Assets are
  # served through the app's /api/assets proxy, so the bucket stays private.
  createbuckets:
    image: minio/mc:latest
    container_name: osint-board-createbuckets
    depends_on:
      - minio
    entrypoint: >
      /bin/sh -c "
      until mc alias set gupi http://minio:9000 gupi gupi_secret; do echo 'waiting for minio...'; sleep 1; done;
      mc mb --ignore-existing gupi/gupi;
      echo 'gupi bucket ready';
      "

volumes:
  osint_postgres_data:
  osint_minio_data: