x-landppt-build: &landppt-build
  context: .
  dockerfile: Dockerfile
  args:
    - APT_DEBIAN_URL=${APT_DEBIAN_URL:-http://deb.debian.org/debian}
    - APT_SECURITY_URL=${APT_SECURITY_URL:-http://deb.debian.org/debian-security}

x-landppt-volumes: &landppt-volumes
  - ./:/app
  - ${LANDPPT_ENV_FILE:-./.env}:/app/.env
  - landppt_data:/app/data
  - landppt_uploads:/app/uploads
  - landppt_reports:/app/research_reports
  - landppt_cache:/app/temp
  - landppt_lib:/app/lib

x-landppt-env: &landppt-env
  PYTHONPATH: /opt/venv/lib/python3.11/site-packages:/app/src
  PYTHONUNBUFFERED: "1"
  HOST: ${HOST:-0.0.0.0}
  PORT: ${PORT:-8000}
  LOG_LEVEL: ${LOG_LEVEL:-info}
  SECRET_KEY: ${SECRET_KEY:-your-secret-key-change-me}
  LANDPPT_API_KEY: ${LANDPPT_API_KEY:-}
  LANDPPT_API_KEY_USER: ${LANDPPT_API_KEY_USER:-admin}
  LANDPPT_API_KEYS: ${LANDPPT_API_KEYS:-}
  LANDPPT_BOOTSTRAP_ADMIN_ENABLED: ${LANDPPT_BOOTSTRAP_ADMIN_ENABLED:-true}
  LANDPPT_BOOTSTRAP_ADMIN_USERNAME: ${LANDPPT_BOOTSTRAP_ADMIN_USERNAME:-admin}
  LANDPPT_BOOTSTRAP_ADMIN_PASSWORD: ${LANDPPT_BOOTSTRAP_ADMIN_PASSWORD:-admin123}
  LANDPPT_ENABLE_API_DOCS: ${LANDPPT_ENABLE_API_DOCS:-true}
  LANDPPT_ALLOW_HEADER_SESSION_AUTH: ${LANDPPT_ALLOW_HEADER_SESSION_AUTH:-false}
  INVITE_CODE_REQUIRED_FOR_REGISTRATION: ${INVITE_CODE_REQUIRED_FOR_REGISTRATION:-false}
  LANDPPT_AUTO_MIGRATE_ON_STARTUP: ${LANDPPT_AUTO_MIGRATE_ON_STARTUP:-true}
  LANDPPT_AUTO_MIGRATE_FAIL_FAST: ${LANDPPT_AUTO_MIGRATE_FAIL_FAST:-true}
  LANDPPT_AUTO_MIGRATE_LOCK_TIMEOUT_SECONDS: ${LANDPPT_AUTO_MIGRATE_LOCK_TIMEOUT_SECONDS:-300}
  LANDPPT_AUTO_MIGRATE_LOCK_STALE_SECONDS: ${LANDPPT_AUTO_MIGRATE_LOCK_STALE_SECONDS:-900}
  DATABASE_URL: postgresql://${POSTGRES_USER:-landppt}:${POSTGRES_PASSWORD:-landppt}@postgres:5432/${POSTGRES_DB:-landppt}
  CACHE_BACKEND: valkey
  VALKEY_URL: valkey://valkey:${VALKEY_PORT:-6379}
  TASK_EXECUTION_MODE: queue
  TASK_QUEUE_NAME: ${TASK_QUEUE_NAME:-default}
  STORAGE_BACKEND: ${STORAGE_BACKEND:-s3}
  LOCAL_STORAGE_ROOT: ${LOCAL_STORAGE_ROOT:-/app/data/artifacts}
  LOCAL_STORAGE_PUBLIC_BASE_URL: ${LOCAL_STORAGE_PUBLIC_BASE_URL:-}
  S3_ENDPOINT_URL: ${S3_ENDPOINT_URL:-http://minio:9000}
  S3_REGION: ${S3_REGION:-us-east-1}
  S3_BUCKET: ${S3_BUCKET:-landppt}
  S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-landppt}
  S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-landppt-minio-secret}
  S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE:-true}
  S3_PUBLIC_BASE_URL: ${S3_PUBLIC_BASE_URL:-}
  S3_PRESIGNED_URL_EXPIRES_SECONDS: ${S3_PRESIGNED_URL_EXPIRES_SECONDS:-3600}

x-landppt-depends-on: &landppt-depends-on
  permissions-init:
    condition: service_completed_successfully
  postgres:
    condition: service_healthy
  valkey:
    condition: service_healthy
  minio:
    condition: service_healthy
  minio-init:
    condition: service_completed_successfully

services:
  permissions-init:
    build: *landppt-build
    image: ${LANDPPT_DEV_IMAGE:-landppt-dev:latest}
    user: "0:0"
    entrypoint: ["/usr/local/bin/docker-permissions-init.sh"]
    environment:
      LANDPPT_UID: "10001"
      LANDPPT_GID: "10001"
    volumes:
      - ${LANDPPT_ENV_FILE:-./.env}:/mnt/landppt/env/.env
      - landppt_data:/mnt/landppt/data
      - landppt_uploads:/mnt/landppt/uploads
      - landppt_reports:/mnt/landppt/reports
      - landppt_cache:/mnt/landppt/cache
      - landppt_lib:/mnt/landppt/lib
    network_mode: "none"
    read_only: true
    restart: "no"
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - FOWNER
      - DAC_OVERRIDE
      - SETUID
      - SETGID
    security_opt:
      - no-new-privileges:true
    healthcheck:
      disable: true

  landppt:
    build: *landppt-build
    image: ${LANDPPT_DEV_IMAGE:-landppt-dev:latest}
    shm_size: ${LANDPPT_SHM_SIZE:-2gb}
    ports:
      - "${LANDPPT_PORT:-8000}:8000"
    volumes: *landppt-volumes
    environment:
      <<: *landppt-env
      WORKERS: ${WORKERS:-1}
      RELOAD: ${RELOAD:-true}
      UVICORN_TIMEOUT_WORKER_HEALTHCHECK: ${UVICORN_TIMEOUT_WORKER_HEALTHCHECK:-60}
      OPENAI_USE_RESPONSES_API: ${OPENAI_USE_RESPONSES_API:-false}
      OPENAI_ENABLE_REASONING: ${OPENAI_ENABLE_REASONING:-false}
      OPENAI_REASONING_EFFORT: ${OPENAI_REASONING_EFFORT:-medium}
    depends_on: *landppt-depends-on
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "/usr/local/bin/docker-healthcheck.sh"]
      interval: 30s
      timeout: 30s
      retries: 3
      start_period: 40s
    networks:
      - landppt_network

  worker:
    build: *landppt-build
    image: ${LANDPPT_DEV_IMAGE:-landppt-dev:latest}
    command: ["python", "-m", "landppt.cli", "worker", "--queue", "${TASK_QUEUE_NAME:-default}"]
    shm_size: ${LANDPPT_SHM_SIZE:-2gb}
    volumes: *landppt-volumes
    environment: *landppt-env
    depends_on: *landppt-depends-on
    healthcheck:
      disable: true
    restart: unless-stopped
    networks:
      - landppt_network

  postgres:
    image: postgres:16-alpine
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-landppt}
      POSTGRES_USER: ${POSTGRES_USER:-landppt}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-landppt}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - landppt_network
    restart: unless-stopped

  valkey:
    image: valkey/valkey:8-alpine
    command: valkey-server --appendonly yes
    volumes:
      - valkey_data:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - landppt_network
    restart: unless-stopped

  minio:
    image: minio/minio:RELEASE.2025-04-22T22-12-26Z
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-landppt}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-landppt-minio-secret}
    ports:
      - "${MINIO_API_PORT:-9000}:9000"
      - "${MINIO_CONSOLE_PORT:-9001}:9001"
    volumes:
      - minio_data:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - landppt_network
    restart: unless-stopped

  minio-init:
    image: minio/mc:RELEASE.2025-04-16T18-13-26Z
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set local http://minio:9000 $${MINIO_ROOT_USER:-landppt} $${MINIO_ROOT_PASSWORD:-landppt-minio-secret};
      mc mb -p local/$${S3_BUCKET:-landppt} || true;
      exit 0;
      "
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-landppt}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-landppt-minio-secret}
      S3_BUCKET: ${S3_BUCKET:-landppt}
    networks:
      - landppt_network

volumes:
  landppt_data:
    driver: local
  landppt_uploads:
    driver: local
  landppt_reports:
    driver: local
  landppt_cache:
    driver: local
  landppt_lib:
    driver: local
  postgres_data:
    driver: local
  valkey_data:
    driver: local
  minio_data:
    driver: local

networks:
  landppt_network:
    driver: bridge