version: "3.8"

services:
  db:
    image: postgres:16-alpine
    container_name: hyb-oa-trialrun-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    ports:
      - "5432:5432"
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 10

  minio:
    image: minio/minio:RELEASE.2025-01-20T14-49-07Z
    container_name: hyb-oa-trialrun-minio
    restart: unless-stopped
    profiles: ["minio"]
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    command: ["server", "/data", "--console-address", ":9001"]
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - ./data/minio:/data

  minio_init:
    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
    container_name: hyb-oa-trialrun-minio-init
    profiles: ["minio"]
    depends_on:
      - minio
    entrypoint: ["sh", "-c"]
    command: |
      set -e
      for i in $$(seq 1 60); do
        mc alias set local http://minio:9000 "$$MINIO_ROOT_USER" "$$MINIO_ROOT_PASSWORD" && break || true
        sleep 1
      done
      mc mb --ignore-existing "local/$$S3_BUCKET"

  server:
    build:
      context: ../..
      dockerfile: deploy/trialrun/Dockerfile
    container_name: hyb-oa-trialrun-server
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
    environment:
      NODE_ENV: production
      METRICS_ENABLED: ${METRICS_ENABLED}
      APP_ORIGIN: ${APP_ORIGIN}
      JWT_SECRET: ${JWT_SECRET}
      FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
      OIDC_ENABLED: ${OIDC_ENABLED}
      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
      OIDC_SCOPES: ${OIDC_SCOPES}
      DATABASE_URL: ${DATABASE_URL}
      STORAGE_DIR: ${STORAGE_DIR}
      STORAGE_DRIVER: ${STORAGE_DRIVER}
      S3_ENDPOINT: ${S3_ENDPOINT}
      S3_REGION: ${S3_REGION}
      S3_BUCKET: ${S3_BUCKET}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
      S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE}
      HOST: ${HOST}
      PORT: ${PORT}
      COOKIE_SECURE: ${COOKIE_SECURE}
      SERVE_CLIENT_DIST: ${SERVE_CLIENT_DIST}
      CLIENT_DIST_DIR: ${CLIENT_DIST_DIR}

      RATE_LIMIT_ENABLED: ${RATE_LIMIT_ENABLED}
      RATE_LIMIT_LOGIN_MAX: ${RATE_LIMIT_LOGIN_MAX}
      RATE_LIMIT_LOGIN_WINDOW: ${RATE_LIMIT_LOGIN_WINDOW}

      OCR_PROVIDER: ${OCR_PROVIDER}
      OCR_MAX_ATTEMPTS: ${OCR_MAX_ATTEMPTS}
      OCR_POLL_CRON: ${OCR_POLL_CRON}
      OCR_BATCH_SIZE: ${OCR_BATCH_SIZE}
      OCR_LOCK_TTL_SECONDS: ${OCR_LOCK_TTL_SECONDS}
      OCR_TIMEOUT_MS: ${OCR_TIMEOUT_MS}
      TENCENT_SECRET_ID: ${TENCENT_SECRET_ID}
      TENCENT_SECRET_KEY: ${TENCENT_SECRET_KEY}
      TENCENT_OCR_REGION: ${TENCENT_OCR_REGION}

      DELEGATION_REVOKE_CRON: ${DELEGATION_REVOKE_CRON}

      JOB_DRIVER: ${JOB_DRIVER}
      JOBS_ENABLED: ${JOBS_ENABLED}
      PG_BOSS_SCHEMA: ${PG_BOSS_SCHEMA}
    ports:
      - "3000:3000"
    volumes:
      - ./data/storage:${STORAGE_DIR}

  worker:
    build:
      context: ../..
      dockerfile: deploy/trialrun/Dockerfile
    container_name: hyb-oa-trialrun-worker
    restart: unless-stopped
    profiles: ["worker"]
    depends_on:
      db:
        condition: service_healthy
    command: ["npm", "run", "worker"]
    environment:
      NODE_ENV: production
      METRICS_ENABLED: ${METRICS_ENABLED}
      APP_ORIGIN: ${APP_ORIGIN}
      JWT_SECRET: ${JWT_SECRET}
      FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
      OIDC_ENABLED: ${OIDC_ENABLED}
      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
      OIDC_SCOPES: ${OIDC_SCOPES}
      DATABASE_URL: ${DATABASE_URL}
      STORAGE_DIR: ${STORAGE_DIR}
      STORAGE_DRIVER: ${STORAGE_DRIVER}
      S3_ENDPOINT: ${S3_ENDPOINT}
      S3_REGION: ${S3_REGION}
      S3_BUCKET: ${S3_BUCKET}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
      S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE}
      SERVE_CLIENT_DIST: "false"
      CLIENT_DIST_DIR: ${CLIENT_DIST_DIR}

      OCR_PROVIDER: ${OCR_PROVIDER}
      OCR_MAX_ATTEMPTS: ${OCR_MAX_ATTEMPTS}
      OCR_POLL_CRON: ${OCR_POLL_CRON}
      OCR_BATCH_SIZE: ${OCR_BATCH_SIZE}
      OCR_LOCK_TTL_SECONDS: ${OCR_LOCK_TTL_SECONDS}
      OCR_TIMEOUT_MS: ${OCR_TIMEOUT_MS}
      TENCENT_SECRET_ID: ${TENCENT_SECRET_ID}
      TENCENT_SECRET_KEY: ${TENCENT_SECRET_KEY}
      TENCENT_OCR_REGION: ${TENCENT_OCR_REGION}

      DELEGATION_REVOKE_CRON: ${DELEGATION_REVOKE_CRON}

      JOB_DRIVER: ${JOB_DRIVER}
      JOBS_ENABLED: "true"
      PG_BOSS_SCHEMA: ${PG_BOSS_SCHEMA}
    volumes:
      - ./data/storage:${STORAGE_DIR}

  init:
    build:
      context: ../..
      dockerfile: deploy/trialrun/Dockerfile
    container_name: hyb-oa-trialrun-init
    depends_on:
      db:
        condition: service_healthy
    environment:
      NODE_ENV: production
      METRICS_ENABLED: ${METRICS_ENABLED}
      APP_ORIGIN: ${APP_ORIGIN}
      JWT_SECRET: ${JWT_SECRET}
      FIELD_ENCRYPTION_KEY: ${FIELD_ENCRYPTION_KEY}
      OIDC_ENABLED: ${OIDC_ENABLED}
      OIDC_ISSUER_URL: ${OIDC_ISSUER_URL}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI}
      OIDC_SCOPES: ${OIDC_SCOPES}
      DATABASE_URL: ${DATABASE_URL}
      STORAGE_DIR: ${STORAGE_DIR}
      STORAGE_DRIVER: ${STORAGE_DRIVER}
      S3_ENDPOINT: ${S3_ENDPOINT}
      S3_REGION: ${S3_REGION}
      S3_BUCKET: ${S3_BUCKET}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY}
      S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE}
      SERVE_CLIENT_DIST: ${SERVE_CLIENT_DIST}
      CLIENT_DIST_DIR: ${CLIENT_DIST_DIR}
      OCR_PROVIDER: ${OCR_PROVIDER}
      OCR_POLL_CRON: ${OCR_POLL_CRON}
      OCR_BATCH_SIZE: ${OCR_BATCH_SIZE}
      OCR_LOCK_TTL_SECONDS: ${OCR_LOCK_TTL_SECONDS}
      OCR_MAX_ATTEMPTS: ${OCR_MAX_ATTEMPTS}
      OCR_TIMEOUT_MS: ${OCR_TIMEOUT_MS}
      TENCENT_SECRET_ID: ${TENCENT_SECRET_ID}
      TENCENT_SECRET_KEY: ${TENCENT_SECRET_KEY}
      TENCENT_OCR_REGION: ${TENCENT_OCR_REGION}
      DELEGATION_REVOKE_CRON: ${DELEGATION_REVOKE_CRON}
      JOB_DRIVER: ${JOB_DRIVER}
      JOBS_ENABLED: ${JOBS_ENABLED}
      PG_BOSS_SCHEMA: ${PG_BOSS_SCHEMA}

      TRIALRUN_ADMIN_EMAIL: ${TRIALRUN_ADMIN_EMAIL}
      TRIALRUN_ADMIN_PHONE: ${TRIALRUN_ADMIN_PHONE}
      TRIALRUN_ADMIN_PASSWORD: ${TRIALRUN_ADMIN_PASSWORD}
    volumes:
      - ./data/storage:${STORAGE_DIR}
    entrypoint: ["sh", "-c"]
    command: >
      "cd /app/server
      && npm run prisma:migrate:deploy
      && npm run seed:config
      && npm run seed:trialrun"
    restart: "no"