# ─────────────────────────────────────────────────────
# CertBridge Central Server — Docker Compose
# ─────────────────────────────────────────────────────
#
# 전략: 기존 n8n 스택의 PostgreSQL, Redis, MinIO를 재활용
# CertBridge 전용 DB/버킷만 추가하여 자원 최소화
#
# 기존 활용 (n8n 스택):
#   - PostgreSQL 16 (pgvector)  → 포트 5432, 새 DB "certbridge" 추가
#   - Redis 7                   → 포트 6379, DB index 2 사용
#   - MinIO                     → 포트 9000/9001, 버킷 "certbridge" 추가
#
# 신규 (이 Compose):
#   - certbridge-api            → 포트 8090 (Go/Node API 서버)
#
# 사용법:
#   # 1. 기존 인프라에 CertBridge DB/버킷 초기화
#   ./scripts/init-shared-infra.sh
#
#   # 2. API 서버만 기동
#   docker compose up -d
#
#   # 전체 독립 실행 (기존 인프라 없을 때)
#   docker compose --profile standalone up -d
# ─────────────────────────────────────────────────────

services:
  # ═══════════════════════════════════════════════════
  # CertBridge API 서버 (항상 기동)
  # ═══════════════════════════════════════════════════
  certbridge-api:
    image: certbridge-api:v0.1.0
    container_name: certbridge-api
    restart: unless-stopped
    ports:
      - "8090:8090"
    environment:
      # PostgreSQL — 기존 n8n-postgres 컨테이너에 직접 연결
      DATABASE_URL: ${DATABASE_URL:-postgres://n8n:n8n_password@n8n-postgres:5432/certbridge}
      # Redis — 기존 n8n-redis 컨테이너, DB index 2
      REDIS_URL: ${REDIS_URL:-redis://n8n-redis:6379/2}
      # MinIO — 기존 n8n-minio 컨테이너
      MINIO_ENDPOINT: ${MINIO_ENDPOINT:-n8n-minio:9000}
      MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY:-minioadmin}
      MINIO_SECRET_KEY: ${MINIO_SECRET_KEY:-minioadmin}
      MINIO_BUCKET: ${MINIO_BUCKET:-certbridge}
      MINIO_USE_SSL: "false"
      # API 설정
      API_PORT: "8090"
      JWT_SECRET: ${JWT_SECRET:-certbridge-jwt-secret-change-in-production}
      RUST_LOG: info
      # Neo4j — 온톨로지 그래프 DB
      NEO4J_URI: ${NEO4J_URI:-bolt://certbridge-neo4j:7687}
      NEO4J_USER: ${NEO4J_USER:-neo4j}
      NEO4J_PASSWORD: ${NEO4J_PASSWORD:-certbridge123}
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8090/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - n8n_n8n-network
      - certbridge-net

  # ═══════════════════════════════════════════════════
  # Standalone 프로필 — 기존 인프라 없을 때만 사용
  # ═══════════════════════════════════════════════════

  certbridge-db:
    image: pgvector/pgvector:pg16
    container_name: certbridge-db
    profiles: ["standalone"]
    restart: unless-stopped
    ports:
      - "5433:5432"
    environment:
      POSTGRES_DB: certbridge
      POSTGRES_USER: certbridge
      POSTGRES_PASSWORD: certbridge_pass
    volumes:
      - certbridge_pg_data:/var/lib/postgresql/data
      - ./init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U certbridge -d certbridge"]
      interval: 10s
      timeout: 3s
      retries: 5
    networks:
      - certbridge-net

  certbridge-redis:
    image: redis:7-alpine
    container_name: certbridge-redis
    profiles: ["standalone"]
    restart: unless-stopped
    ports:
      - "6380:6379"
    volumes:
      - certbridge_redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 3
    networks:
      - certbridge-net

  certbridge-minio:
    image: minio/minio:latest
    container_name: certbridge-minio
    profiles: ["standalone"]
    restart: unless-stopped
    ports:
      - "9010:9000"
      - "9011:9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    command: server /data --console-address ":9001"
    volumes:
      - certbridge_minio_data:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 30s
      timeout: 5s
      retries: 3
    networks:
      - certbridge-net

  # ═══════════════════════════════════════════════════
  # Neo4j Graph Database — 온톨로지 저장소
  # ═══════════════════════════════════════════════════
  certbridge-neo4j:
    image: neo4j:5-community
    container_name: certbridge-neo4j
    restart: unless-stopped
    ports:
      - "7474:7474"    # Browser UI
      - "7687:7687"    # Bolt protocol
    environment:
      NEO4J_AUTH: neo4j/${NEO4J_PASSWORD:-certbridge123}
      NEO4J_PLUGINS: '["apoc"]'
      NEO4J_server_memory_heap_initial__size: "256m"
      NEO4J_server_memory_heap_max__size: "512m"
    volumes:
      - certbridge_neo4j_data:/data
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:7474 || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    networks:
      - certbridge-net
      - n8n_n8n-network

  # ═══════════════════════════════════════════════════
  # Nginx Proxy Manager — Reverse Proxy 및 SSL 터미네이션
  # ═══════════════════════════════════════════════════
  certbridge-npm:
    image: jc21/nginx-proxy-manager:latest
    container_name: certbridge-npm
    profiles: ["standalone"]
    restart: unless-stopped
    ports:
      - "80:80"       # Edge HTTP
      - "443:443"     # Edge HTTPS
      - "81:81"       # NPM Admin UI
    volumes:
      - certbridge_npm_data:/data
      - certbridge_npm_letsencrypt:/etc/letsencrypt
    networks:
      - certbridge-net

  # ═══════════════════════════════════════════════════
  # Authentik Server — 중앙 SSO / OAuth2 및 Proxy Provider
  # ═══════════════════════════════════════════════════
  certbridge-authentik-server:
    image: ghcr.io/goauthentik/server:2024.4.2
    container_name: certbridge-authentik-server
    profiles: ["standalone"]
    restart: unless-stopped
    command: server
    environment:
      AUTHENTIK_REDIS__HOST: certbridge-redis
      AUTHENTIK_REDIS__DB: "3"
      AUTHENTIK_POSTGRESQL__HOST: certbridge-db
      AUTHENTIK_POSTGRESQL__USER: certbridge
      AUTHENTIK_POSTGRESQL__PASSWORD: certbridge_pass
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-certbridge-authentik-secret-key-change-in-production}
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
    volumes:
      - certbridge_authentik_media:/media
      - certbridge_authentik_templates:/templates
    ports:
      - "9000:9000"
      - "9443:9443"
    networks:
      - certbridge-net
    depends_on:
      certbridge-db:
        condition: service_healthy
      certbridge-redis:
        condition: service_healthy

  # ═══════════════════════════════════════════════════
  # Authentik Worker — 백그라운드 태스크 및 배치 처리기
  # ═══════════════════════════════════════════════════
  certbridge-authentik-worker:
    image: ghcr.io/goauthentik/server:2024.4.2
    container_name: certbridge-authentik-worker
    profiles: ["standalone"]
    restart: unless-stopped
    command: worker
    environment:
      AUTHENTIK_REDIS__HOST: certbridge-redis
      AUTHENTIK_REDIS__DB: "3"
      AUTHENTIK_POSTGRESQL__HOST: certbridge-db
      AUTHENTIK_POSTGRESQL__USER: certbridge
      AUTHENTIK_POSTGRESQL__PASSWORD: certbridge_pass
      AUTHENTIK_POSTGRESQL__NAME: authentik
      AUTHENTIK_SECRET_KEY: ${AUTHENTIK_SECRET_KEY:-certbridge-authentik-secret-key-change-in-production}
      AUTHENTIK_ERROR_REPORTING__ENABLED: "false"
    user: "root"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - certbridge_authentik_media:/media
      - certbridge_authentik_templates:/templates
    networks:
      - certbridge-net
    depends_on:
      certbridge-db:
        condition: service_healthy
      certbridge-redis:
        condition: service_healthy

volumes:
  certbridge_pg_data:
  certbridge_redis_data:
  certbridge_minio_data:
  certbridge_neo4j_data:
  certbridge_npm_data:
  certbridge_npm_letsencrypt:
  certbridge_authentik_media:
  certbridge_authentik_templates:

networks:
  n8n_n8n-network:
    external: true
  certbridge-net:
    driver: bridge