services:
  backend:
    restart: unless-stopped
    build:
      context: ./backend
      dockerfile: Dockerfile
    environment:
      SPRING_DATASOURCE_URL: jdbc:postgresql://db:5432/${POSTGRES_DB:-app_db}
      POSTGRES_USER: ${POSTGRES_USER:-myuser}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD должен быть задан в .env}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET должен быть задан в .env}
      JWT_ACCESS_TOKEN_TTL: ${JWT_ACCESS_TOKEN_TTL:-15m}
      JWT_REFRESH_TOKEN_TTL: ${JWT_REFRESH_TOKEN_TTL:-7d}
      JWT_REFRESH_COOKIE_NAME: ${JWT_REFRESH_COOKIE_NAME:-magistr_refresh}
      JWT_REFRESH_COOKIE_SECURE: ${JWT_REFRESH_COOKIE_SECURE:-false}
      JWT_REFRESH_CLEANUP_ENABLED: ${JWT_REFRESH_CLEANUP_ENABLED:-true}
      JWT_REFRESH_CLEANUP_RETENTION: ${JWT_REFRESH_CLEANUP_RETENTION:-30d}
      JWT_REFRESH_CLEANUP_BATCH_SIZE: ${JWT_REFRESH_CLEANUP_BATCH_SIZE:-500}
      JWT_REFRESH_CLEANUP_MAX_BATCHES: ${JWT_REFRESH_CLEANUP_MAX_BATCHES:-20}
      JWT_REFRESH_CLEANUP_INTERVAL_MS: ${JWT_REFRESH_CLEANUP_INTERVAL_MS:-3600000}
      JWT_REFRESH_CLEANUP_INITIAL_DELAY_MS: ${JWT_REFRESH_CLEANUP_INITIAL_DELAY_MS:-60000}
      LOGIN_RATE_MAX_FAILURES: ${LOGIN_RATE_MAX_FAILURES:-5}
      LOGIN_RATE_ATTEMPT_WINDOW: ${LOGIN_RATE_ATTEMPT_WINDOW:-15m}
      LOGIN_RATE_BASE_BLOCK_DURATION: ${LOGIN_RATE_BASE_BLOCK_DURATION:-1m}
      LOGIN_RATE_MAX_BLOCK_DURATION: ${LOGIN_RATE_MAX_BLOCK_DURATION:-15m}
      LOGIN_AUDIT_CLEANUP_ENABLED: ${LOGIN_AUDIT_CLEANUP_ENABLED:-true}
      LOGIN_AUDIT_RETENTION: ${LOGIN_AUDIT_RETENTION:-90d}
      LOGIN_AUDIT_CLEANUP_BATCH_SIZE: ${LOGIN_AUDIT_CLEANUP_BATCH_SIZE:-500}
      LOGIN_AUDIT_CLEANUP_MAX_BATCHES: ${LOGIN_AUDIT_CLEANUP_MAX_BATCHES:-20}
      LOGIN_AUDIT_CLEANUP_INTERVAL_MS: ${LOGIN_AUDIT_CLEANUP_INTERVAL_MS:-86400000}
      LOGIN_AUDIT_CLEANUP_INITIAL_DELAY_MS: ${LOGIN_AUDIT_CLEANUP_INITIAL_DELAY_MS:-120000}
      TRUSTED_PROXY_CIDRS: ${TRUSTED_PROXY_CIDRS:-172.16.0.0/12}
      BUSINESS_TIME_ZONE: ${BUSINESS_TIME_ZONE:-Europe/Moscow}
      TZ: ${TZ:-Europe/Moscow}
      JAVA_TOOL_OPTIONS: -Duser.timezone=${TZ:-Europe/Moscow}
      OTEL_SDK_DISABLED: ${OTEL_SDK_DISABLED:-true}
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: [ "CMD-SHELL", "wget --quiet --spider http://127.0.0.1:8080/actuator/health/liveness" ]
      interval: 5s
      timeout: 3s
      retries: 12
      start_period: 20s
    networks:
      - magistr
      - proxy

  frontend:
    restart: unless-stopped
    build:
      context: ./frontend
      dockerfile: Dockerfile
    networks:
      - magistr
      - proxy
    depends_on:
      backend:
        condition: service_healthy

  db:
    image: postgres:16.3-alpine@sha256:36ed71227ae36305d26382657c0b96cbaf298427b3f1eaeb10d77a6dea3eec41
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-myuser}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD должен быть задан в .env}
      POSTGRES_DB: ${POSTGRES_DB:-app_db}
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\"" ]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - magistr
    volumes:
      - postgres_data:/var/lib/postgresql/data

networks:
  magistr:
    driver: bridge
  proxy:
    external: true

volumes:
  postgres_data: