# Betrieb von moneyfy mit Docker Compose.
#
# Vor dem ersten Start: `cp .env.example .env` und die Datei ausfüllen.
# Anschließend genügt `docker compose up -d`; das Backend legt beim Start das
# Schema an und seedt die Stammdaten.

name: moneyfy

services:
  moneyfy-db:
    image: postgres:17-alpine
    container_name: moneyfy-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-moneyfy}
      POSTGRES_USER: ${POSTGRES_USER:-moneyfy}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD muss in .env gesetzt sein}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8"
      TZ: ${TIMEZONE:-Europe/Berlin}
    volumes:
      - moneyfy-pgdata:/var/lib/postgresql/data
    # Die Datenbank ist ausschließlich im internen Netz erreichbar.
    networks:
      - moneyfy
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-moneyfy} -d ${POSTGRES_DB:-moneyfy}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  moneyfy-backend:
    image: git.menzel.center/menzeljonas/moneyfy-backend:${TAG:-latest}
    container_name: moneyfy-backend
    restart: unless-stopped
    depends_on:
      moneyfy-db:
        condition: service_healthy
    environment:
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-moneyfy}:${POSTGRES_PASSWORD}@moneyfy-db:5432/${POSTGRES_DB:-moneyfy}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY muss in .env gesetzt sein, mindestens 32 Zeichen}
      ENVIRONMENT: ${ENVIRONMENT:-production}
      DEBUG: ${DEBUG:-false}
      TIMEZONE: ${TIMEZONE:-Europe/Berlin}
      HOLIDAY_REGION: ${HOLIDAY_REGION:-DE-NW}
      PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:-http://localhost:8087}

      MONEYFY_ADMIN_USER: ${MONEYFY_ADMIN_USER:-admin}
      MONEYFY_ADMIN_PASSWORD: ${MONEYFY_ADMIN_PASSWORD:-}
      ACCESS_TOKEN_TTL_MINUTES: ${ACCESS_TOKEN_TTL_MINUTES:-30}
      REFRESH_TOKEN_TTL_DAYS: ${REFRESH_TOKEN_TTL_DAYS:-14}
      COOKIE_SECURE: ${COOKIE_SECURE:-true}
      COOKIE_DOMAIN: ${COOKIE_DOMAIN:-}

      LOGO_STORAGE_DIR: /data/logos
      LOGODEV_API_KEY: ${LOGODEV_API_KEY:-}
      BRANDFETCH_API_KEY: ${BRANDFETCH_API_KEY:-}
      LOGO_AUTO_RESOLVE: ${LOGO_AUTO_RESOLVE:-true}

      NOTIFICATIONS_ENABLED: ${NOTIFICATIONS_ENABLED:-true}
      SCHEDULER_ENABLED: ${SCHEDULER_ENABLED:-true}
      NOTIFICATION_HOUR: ${NOTIFICATION_HOUR:-7}
      NOTIFICATION_MINUTE: ${NOTIFICATION_MINUTE:-0}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USER: ${SMTP_USER:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      SMTP_FROM: ${SMTP_FROM:-}
      SMTP_USE_TLS: ${SMTP_USE_TLS:-true}
      SMTP_USE_SSL: ${SMTP_USE_SSL:-false}
      APPRISE_URLS: ${APPRISE_URLS:-}
    volumes:
      # Logo-Cache; die Dateien überleben ein Update des Images.
      - moneyfy-data:/data
    networks:
      - moneyfy
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 40s

  moneyfy-frontend:
    image: git.menzel.center/menzeljonas/moneyfy-frontend:${TAG:-latest}
    container_name: moneyfy-frontend
    restart: unless-stopped
    depends_on:
      moneyfy-backend:
        condition: service_healthy
    ports:
      # Nur lokal gebunden – von außen kommt man ausschließlich über NPMplus.
      - "127.0.0.1:8087:8080"
    networks:
      # `moneyfy` für den Weg zum Backend, `proxy` für NPMplus.
      - moneyfy
      - proxy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

networks:
  moneyfy:
    driver: bridge
  proxy:
    external: true

volumes:
  moneyfy-pgdata:
    name: moneyfy-pgdata
  moneyfy-data:
    name: moneyfy-data