# Clusev — DEV stack. Host has only Docker; everything runs here.
# Tooling:  docker compose run --rm --no-deps -u "${HOST_UID:-1002}:${HOST_GID:-1002}" app <composer|php artisan|npm ...>
name: clusev

x-app: &app
  build:
    context: .
    dockerfile: Dockerfile
    target: dev
    args:
      APP_UID: "${HOST_UID:-1002}"
      APP_GID: "${HOST_GID:-1002}"
  image: clusev-app:dev
  restart: unless-stopped
  volumes:
    - .:/var/www/html
    - ./run:/var/www/html/storage/app/restart-signal
    # Bind the nginx config so a proxy change (e.g. the /terminal/ws upgrade) is picked up on a
    # container restart instead of an image rebuild. Harmless on the non-nginx (*app) workers.
    - ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
  networks:
    - clusev

services:
  # php-fpm + nginx + vite, all via supervisor in ONE container.
  # Vite is NOT a separate service — it comes up with the app (HMR on :5173).
  app:
    <<: *app
    ports:
      - "${APP_PORT:-80}:80"
      - "${VITE_PORT:-5173}:5173"
    # ONLY the web container serves the (admin-gated) "Clusev host" Docker view, so ONLY it gets a
    # route to the host gateway. Keeping it off the reverb/queue/scheduler workers (which run
    # background code, not role-gated HTTP) denies them a network path to a root shell on the host
    # if one were ever compromised — least privilege for the stored root HostCredential.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      mariadb:
        condition: service_healthy
      redis:
        condition: service_started

  reverb:
    <<: *app
    user: "${HOST_UID:-1002}:${HOST_GID:-1002}"
    command: php artisan reverb:start --host=0.0.0.0 --port=8080
    ports:
      - "${REVERB_HOST_PORT:-8080}:8080"
    depends_on:
      redis:
        condition: service_started

  queue:
    <<: *app
    user: "${HOST_UID:-1002}:${HOST_GID:-1002}"
    command: php artisan queue:work --tries=3 --timeout=90 --sleep=1
    depends_on:
      mariadb:
        condition: service_healthy
      redis:
        condition: service_started

  # Laravel scheduler loop (every-minute clusev:wg-sample, daily clusev:prune-audit).
  scheduler:
    <<: *app
    user: "${HOST_UID:-1002}:${HOST_GID:-1002}"
    command: php artisan schedule:work
    depends_on:
      mariadb:
        condition: service_healthy
      redis:
        condition: service_started

  mariadb:
    image: mariadb:11
    restart: unless-stopped
    environment:
      MARIADB_DATABASE: "${DB_DATABASE:-clusev}"
      MARIADB_USER: "${DB_USERNAME:-clusev}"
      MARIADB_PASSWORD: "${DB_PASSWORD:?set DB_PASSWORD in .env}"
      MARIADB_ROOT_PASSWORD: "${DB_ROOT_PASSWORD:?set DB_ROOT_PASSWORD in .env}"
    volumes:
      - mariadb-data:/var/lib/mysql
      # Quiet the protocol-normal "Aborted connection" WARNINGs (log_warnings=1) + worker timeouts.
      - ./docker/mariadb/tuning.cnf:/etc/mysql/conf.d/tuning.cnf:ro
    ports:
      # localhost-only: reachable from the host (DB tools / SSH tunnel), not the whole network.
      - "127.0.0.1:${DB_PORT:-3306}:3306"
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 5s
      timeout: 5s
      retries: 30
    networks:
      - clusev

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --appendonly yes
    volumes:
      - redis-data:/data
    networks:
      - clusev

  # Terminal sidecar: bridges the browser WebSocket (/terminal/ws via nginx) to an SSH PTY (per
  # server) or a local shell PTY (the Clusev "host" terminal). php-fpm cannot hold a PTY.
  terminal:
    build:
      context: ./docker/terminal
    image: clusev-terminal:dev
    restart: unless-stopped
    # Reach the Docker host's sshd from the sidecar so the "Clusev host" terminal can SSH into the
    # real machine (host.docker.internal → the host gateway).
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      TERMINAL_SIDECAR_SECRET: "${TERMINAL_SIDECAR_SECRET:-}"
      APP_INTERNAL_URL: "http://app:80"
    volumes:
      # Dev: bind the sidecar source over the baked copy so edits need only `restart terminal`
      # (no rebuild). Prod bakes it into the image (no mount) — see docker-compose.prod.yml.
      - ./docker/terminal/server.js:/app/server.js:ro
    networks:
      - clusev

volumes:
  mariadb-data:
  redis-data:

networks:
  clusev:
    driver: bridge
