version: '3.8'

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: gestion_locative
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    restart: unless-stopped

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    ports:
      - "3001:3001"
    volumes:
      - ./backend/uploads:/app/uploads
    environment:
      - NODE_ENV=production
      - JWT_SECRET=change_this_secret_in_production
      - PGHOST=postgres
      - PGPORT=5432
      - PGUSER=postgres
      - PGPASSWORD=postgres
      - PGDATABASE=gestion_locative
      # SSO OIDC (optionnel — laisser vide pour désactiver)
      - OIDC_ISSUER=${OIDC_ISSUER:-}
      - OIDC_CLIENT_ID=${OIDC_CLIENT_ID:-}
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-}
      - OIDC_REDIRECT_URI=${OIDC_REDIRECT_URI:-http://localhost:3001/api/auth/oidc/callback}
      - OIDC_SCOPE=${OIDC_SCOPE:-openid email profile}
      - OIDC_BUTTON_LABEL=${OIDC_BUTTON_LABEL:-Se connecter via SSO}
      - FRONTEND_URL=${FRONTEND_URL:-http://localhost:3000}
      # INSEE API (optionnel — pour récupérer l'IRL automatiquement)
      - INSEE_API_TOKEN=${INSEE_API_TOKEN:-}
    depends_on:
      - postgres
    restart: unless-stopped

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    ports:
      - "3000:80"
    environment:
      - BACKEND_URL=${BACKEND_URL:-http://backend:3001}
    depends_on:
      - backend
    restart: unless-stopped

volumes:
  postgres_data: