###############################################################################
# Changemaker Lite v2 — Docker Compose
###############################################################################

services:
  # =========================================================================
  # V2 CORE SERVICES
  # =========================================================================

  # Unified Express.js API
  api:
    build:
      context: ./api
      target: development
    container_name: changemaker-v2-api
    restart: unless-stopped
    ports:
      - "${API_PORT:-4000}:4000"
      - "${LISTMONK_PROXY_PORT:-9002}:9002"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:4000/api/health"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 30s
    environment:
      - NODE_ENV=${NODE_ENV:-development}
      - PORT=4000
      - DATABASE_URL=postgresql://${V2_POSTGRES_USER:-changemaker}:${V2_POSTGRES_PASSWORD:-changemaker}@changemaker-v2-postgres:5432/${V2_POSTGRES_DB:-changemaker_v2}
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis-changemaker:6379
      - JWT_ACCESS_SECRET=${JWT_ACCESS_SECRET}
      - JWT_REFRESH_SECRET=${JWT_REFRESH_SECRET}
      - JWT_ACCESS_EXPIRY=${JWT_ACCESS_EXPIRY:-15m}
      - JWT_REFRESH_EXPIRY=${JWT_REFRESH_EXPIRY:-7d}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - INITIAL_ADMIN_EMAIL=${INITIAL_ADMIN_EMAIL:-admin@cmlite.org}
      - INITIAL_ADMIN_PASSWORD=${INITIAL_ADMIN_PASSWORD:-REQUIRED_STRONG_PASSWORD_CHANGE_THIS}
      - SMTP_HOST=${SMTP_HOST:-mailhog-changemaker}
      - SMTP_PORT=${SMTP_PORT:-1025}
      - SMTP_USER=${SMTP_USER:-}
      - SMTP_PASS=${SMTP_PASS:-}
      - SMTP_FROM=${SMTP_FROM:-noreply@cmlite.org}
      - EMAIL_TEST_MODE=${EMAIL_TEST_MODE:-true}
      - LISTMONK_URL=http://listmonk-app:9000
      - LISTMONK_ADMIN_USER=${LISTMONK_ADMIN_USER:-admin}
      - LISTMONK_ADMIN_PASSWORD=${LISTMONK_ADMIN_PASSWORD:-}
      - LISTMONK_SYNC_ENABLED=${LISTMONK_SYNC_ENABLED:-false}
      - LISTMONK_PROXY_PORT=${LISTMONK_PROXY_PORT:-9002}
      - REPRESENT_API_URL=${REPRESENT_API_URL:-https://represent.opennorth.ca}
      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:3000,http://localhost}
      - ADMIN_URL=${ADMIN_URL:-http://localhost:3000}
      - API_URL=${API_URL:-http://localhost:4000}
      - DOMAIN=${DOMAIN:-cmlite.org}
      - NAR_DATA_DIR=/data
      - PANGOLIN_API_URL=${PANGOLIN_API_URL:-}
      - PANGOLIN_API_KEY=${PANGOLIN_API_KEY:-}
      - PANGOLIN_ORG_ID=${PANGOLIN_ORG_ID:-}
      - PANGOLIN_SITE_ID=${PANGOLIN_SITE_ID:-}
      - PANGOLIN_ENDPOINT=${PANGOLIN_ENDPOINT:-}
      - PANGOLIN_NEWT_ID=${PANGOLIN_NEWT_ID:-}
      - PANGOLIN_NEWT_SECRET=${PANGOLIN_NEWT_SECRET:-}
      - NODE_TLS_REJECT_UNAUTHORIZED=${NODE_TLS_REJECT_UNAUTHORIZED:-}
      - EXCALIDRAW_URL=${EXCALIDRAW_URL:-http://excalidraw-changemaker:80}
      - EXCALIDRAW_PORT=${EXCALIDRAW_PORT:-8090}
      - EXCALIDRAW_EMBED_PORT=${EXCALIDRAW_EMBED_PORT:-8886}
      - HOMEPAGE_URL=${HOMEPAGE_URL:-http://homepage-changemaker:3000}
      - HOMEPAGE_EMBED_PORT=${HOMEPAGE_EMBED_PORT:-8887}
    volumes:
      - ./api:/app
      - /app/node_modules
      - ./assets/uploads:/app/uploads
      - ./mkdocs:/mkdocs:rw
      - ./data:/data:ro
      - ./configs:/app/configs:ro
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      v2-postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - changemaker-lite

  # Fastify Media API (Microservice for Media Management)
  media-api:
    build:
      context: ./api
      dockerfile: Dockerfile.media
      target: development
    container_name: changemaker-media-api
    restart: unless-stopped
    ports:
      - "${MEDIA_API_PORT:-4100}:4100"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:4100/health"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 30s
    environment:
      - NODE_ENV=${NODE_ENV:-development}
      - MEDIA_API_PORT=${MEDIA_API_PORT:-4100}
      - DATABASE_URL=postgresql://${V2_POSTGRES_USER:-changemaker}:${V2_POSTGRES_PASSWORD:-changemaker}@changemaker-v2-postgres:5432/${V2_POSTGRES_DB:-changemaker_v2}
      - REDIS_URL=redis://:${REDIS_PASSWORD}@redis-changemaker:6379
      - JWT_ACCESS_SECRET=${JWT_ACCESS_SECRET}
      - JWT_REFRESH_SECRET=${JWT_REFRESH_SECRET}
      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:3000,http://localhost:3100}
      - ENABLE_MEDIA_FEATURES=${ENABLE_MEDIA_FEATURES:-true}
      - MEDIA_ROOT=/media/local
      - MEDIA_UPLOADS=/media/uploads
      - MAX_UPLOAD_SIZE_GB=${MAX_UPLOAD_SIZE_GB:-10}
    volumes:
      - ./api:/app
      - /app/node_modules
      - ${MEDIA_ROOT:-./media}:/media:ro
      - ${MEDIA_ROOT:-./media}/local/inbox:/media/local/inbox:rw
      - ${MEDIA_ROOT:-./media}/local/thumbnails:/media/local/thumbnails:rw
      - ${MEDIA_ROOT:-./media}/public:/media/public:rw
    depends_on:
      v2-postgres:
        condition: service_healthy
    networks:
      - changemaker-lite

  # React Admin GUI (Vite dev server)
  admin:
    build:
      context: ./admin
      target: development
    container_name: changemaker-v2-admin
    restart: unless-stopped
    ports:
      - "${ADMIN_PORT:-3000}:3000"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    environment:
      - DOMAIN=${DOMAIN:-cmlite.org}
      - NODE_ENV=${NODE_ENV:-development}
      - VITE_API_URL=http://changemaker-v2-api:4000
      - VITE_MEDIA_API_URL=${VITE_MEDIA_API_URL:-http://changemaker-media-api:4100}
      - VITE_MKDOCS_URL=http://mkdocs-changemaker:8000
    volumes:
      - ./admin:/app
      - /app/node_modules
    depends_on:
      - api
    networks:
      - changemaker-lite

  # PostgreSQL 16 (v2 database)
  v2-postgres:
    image: postgres:16-alpine
    container_name: changemaker-v2-postgres
    restart: unless-stopped
    ports:
      - "127.0.0.1:${V2_POSTGRES_PORT:-5433}:5432"
    environment:
      POSTGRES_USER: ${V2_POSTGRES_USER:-changemaker}
      POSTGRES_PASSWORD: ${V2_POSTGRES_PASSWORD:-changemaker}
      POSTGRES_DB: ${V2_POSTGRES_DB:-changemaker_v2}
    volumes:
      - v2-postgres-data:/var/lib/postgresql/data
      - ./api/prisma/init-nocodb-db.sh:/docker-entrypoint-initdb.d/init-nocodb-db.sh:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${V2_POSTGRES_USER:-changemaker}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - changemaker-lite

  # Nginx reverse proxy
  nginx:
    build:
      context: ./nginx
    container_name: changemaker-v2-nginx
    restart: unless-stopped
    ports:
      - "${NGINX_HTTP_PORT:-80}:80"
      - "${NGINX_HTTPS_PORT:-443}:443"
      - "8881:8881"   # NocoDB embed proxy (strips X-Frame-Options)
      - "8882:8882"   # n8n embed proxy
      - "8883:8883"   # Gitea embed proxy
      - "8884:8884"   # MailHog embed proxy
      - "8885:8885"   # Mini QR embed proxy
      - "8886:8886"   # Excalidraw embed proxy
      - "8887:8887"   # Homepage embed proxy
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:80/"]
      interval: 30s
      timeout: 5s
      retries: 3
    environment:
      - DOMAIN=${DOMAIN:-cmlite.org}
      - PANGOLIN_SITE_ID=${PANGOLIN_SITE_ID:-}
    volumes:
      # Note: conf.d is NOT mounted (configs are generated at startup from templates)
      - ./public-web:/usr/share/nginx/public-web:ro
      - ./configs/pangolin:/etc/pangolin:ro
    depends_on:
      - api
      - admin
    networks:
      - changemaker-lite

  # NocoDB v2 — pointed at v2 PostgreSQL as read-only data browser
  nocodb-v2:
    image: nocodb/nocodb:latest
    container_name: changemaker-v2-nocodb
    restart: unless-stopped
    ports:
      - "${NOCODB_V2_PORT:-8091}:8080"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/api/v1/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    environment:
      NC_DB: "pg://changemaker-v2-postgres:5432?u=${V2_POSTGRES_USER:-changemaker}&p=${V2_POSTGRES_PASSWORD:-changemaker}&d=nocodb_meta"
      NC_ADMIN_EMAIL: ${NC_ADMIN_EMAIL:-admin@cmlite.org}
      NC_ADMIN_PASSWORD: ${NC_ADMIN_PASSWORD:-admin123}
      NC_PUBLIC_URL: ${NC_PUBLIC_URL:-http://localhost:8091}
    volumes:
      - nocodb-v2-data:/usr/app/data
    depends_on:
      v2-postgres:
        condition: service_healthy
    networks:
      - changemaker-lite

  # =========================================================================
  # SHARED INFRASTRUCTURE (kept from v1)
  # =========================================================================

  # Shared Redis — sessions, BullMQ queues, cache
  redis:
    image: redis:7-alpine
    container_name: redis-changemaker
    command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru --requirepass "${REDIS_PASSWORD}"
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    restart: always
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    networks:
      - changemaker-lite
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "2"

  # Listmonk — Email marketing (kept as Docker image, controlled via REST API)
  listmonk-app:
    image: listmonk/listmonk:latest
    container_name: listmonk-app
    restart: unless-stopped
    ports:
      - "${LISTMONK_PORT:-9001}:9000"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:9000/"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    depends_on:
      - listmonk-db
    command: [sh, -c, "./listmonk --install --idempotent --yes --config '' && ./listmonk --upgrade --yes --config '' && ./listmonk --config ''"]
    environment:
      LISTMONK_app__address: 0.0.0.0:9000
      LISTMONK_db__user: ${LISTMONK_DB_USER:-listmonk}
      LISTMONK_db__password: ${LISTMONK_DB_PASSWORD:-listmonk}
      LISTMONK_db__database: ${LISTMONK_DB_NAME:-listmonk}
      LISTMONK_db__host: listmonk-db
      LISTMONK_db__port: 5432
      LISTMONK_db__ssl_mode: disable
      TZ: Etc/UTC
      LISTMONK_ADMIN_USER: ${LISTMONK_WEB_ADMIN_USER:-admin}
      LISTMONK_ADMIN_PASSWORD: ${LISTMONK_WEB_ADMIN_PASSWORD:-}
    volumes:
      - ./assets/uploads:/listmonk/uploads:rw
    networks:
      - changemaker-lite

  listmonk-db:
    image: postgres:17-alpine
    container_name: listmonk-db
    restart: unless-stopped
    ports:
      - "127.0.0.1:${LISTMONK_DB_PORT:-5432}:5432"
    environment:
      POSTGRES_USER: ${LISTMONK_DB_USER:-listmonk}
      POSTGRES_PASSWORD: ${LISTMONK_DB_PASSWORD:-listmonk}
      POSTGRES_DB: ${LISTMONK_DB_NAME:-listmonk}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${LISTMONK_DB_USER:-listmonk}"]
      interval: 10s
      timeout: 5s
      retries: 6
    volumes:
      - listmonk-data:/var/lib/postgresql/data
    networks:
      - changemaker-lite

  # One-shot: creates the Listmonk API user for V2 integration after tables exist.
  # Safe to re-run (upserts). Exits 0 on success. Set LISTMONK_API_TOKEN in .env.
  listmonk-init:
    image: postgres:17-alpine
    container_name: listmonk-init
    depends_on:
      listmonk-app:
        condition: service_started
    restart: "no"
    environment:
      PGPASSWORD: ${LISTMONK_DB_PASSWORD:-listmonk}
      LISTMONK_API_USER: ${LISTMONK_API_USER:-v2-api}
      LISTMONK_API_TOKEN: ${LISTMONK_API_TOKEN:-}
      LISTMONK_SMTP_HOST: ${LISTMONK_SMTP_HOST:-mailhog-changemaker}
      LISTMONK_SMTP_PORT: ${LISTMONK_SMTP_PORT:-1025}
      LISTMONK_SMTP_USER: ${LISTMONK_SMTP_USER:-}
      LISTMONK_SMTP_PASSWORD: ${LISTMONK_SMTP_PASSWORD:-}
      LISTMONK_SMTP_TLS_TYPE: ${LISTMONK_SMTP_TLS_TYPE:-none}
      LISTMONK_SMTP_FROM: ${LISTMONK_SMTP_FROM:-Changemaker Lite <noreply@cmlite.org>}
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        echo "[listmonk-init] Waiting for Listmonk tables..."
        for i in $$(seq 1 30); do
          if psql -h listmonk-db -U ${LISTMONK_DB_USER:-listmonk} -d ${LISTMONK_DB_NAME:-listmonk} -c "SELECT 1 FROM users LIMIT 1" >/dev/null 2>&1; then
            break
          fi
          sleep 2
        done

        if [ -n "$$LISTMONK_API_TOKEN" ]; then
          echo "[listmonk-init] Upserting API user '$$LISTMONK_API_USER'..."
          psql -h listmonk-db -U ${LISTMONK_DB_USER:-listmonk} -d ${LISTMONK_DB_NAME:-listmonk} -q <<SQL
        INSERT INTO users (username, password, password_login, email, name, type, user_role_id, status)
        VALUES ('$$LISTMONK_API_USER', '$$LISTMONK_API_TOKEN', true, '$$LISTMONK_API_USER@api.internal', '$$LISTMONK_API_USER', 'api', 1, 'enabled')
        ON CONFLICT (username) DO UPDATE SET password = EXCLUDED.password, status = 'enabled', user_role_id = 1;
        SQL
          echo "[listmonk-init] API user configured"
        else
          echo "[listmonk-init] LISTMONK_API_TOKEN not set, skipping API user"
        fi

        if [ -n "$$LISTMONK_SMTP_HOST" ]; then
          echo "[listmonk-init] Configuring SMTP..."
          # Always include MailHog as first provider
          MAILHOG_ENTRY='{"host":"mailhog-changemaker","port":1025,"username":"","password":"","tls_type":"none","auth_protocol":"none","enabled":true,"max_conns":5,"idle_timeout":"15s","wait_timeout":"5s","max_msg_retries":2,"tls_skip_verify":false,"email_headers":[],"hello_hostname":""}'
          if [ -n "$$LISTMONK_SMTP_USER" ]; then
            # Production SMTP as second provider
            PROD_ENTRY='{"host":"'"$$LISTMONK_SMTP_HOST"'","port":'"$$LISTMONK_SMTP_PORT"',"username":"'"$$LISTMONK_SMTP_USER"'","password":"'"$$LISTMONK_SMTP_PASSWORD"'","tls_type":"'"$$LISTMONK_SMTP_TLS_TYPE"'","auth_protocol":"plain","enabled":true,"max_conns":5,"idle_timeout":"15s","wait_timeout":"5s","max_msg_retries":2,"tls_skip_verify":false,"email_headers":[],"hello_hostname":""}'
            SMTP_VALUE="[$$MAILHOG_ENTRY,$$PROD_ENTRY]"
            echo "[listmonk-init] Dual SMTP: MailHog + $$LISTMONK_SMTP_HOST:$$LISTMONK_SMTP_PORT"
          else
            SMTP_VALUE="[$$MAILHOG_ENTRY]"
            echo "[listmonk-init] Single SMTP: MailHog (no production credentials)"
          fi
          psql -h listmonk-db -U ${LISTMONK_DB_USER:-listmonk} -d ${LISTMONK_DB_NAME:-listmonk} -q <<SQL
        UPDATE settings SET value = '$$SMTP_VALUE' WHERE key = 'smtp';
        UPDATE settings SET value = '"$$LISTMONK_SMTP_FROM"' WHERE key = 'app.from_email';
        SQL
          echo "[listmonk-init] SMTP configured"
        else
          echo "[listmonk-init] LISTMONK_SMTP_HOST not set, skipping SMTP config"
        fi

        echo "[listmonk-init] Done"
    networks:
      - changemaker-lite

  # =========================================================================
  # PLATFORM SERVICES (kept from v1)
  # =========================================================================

  # Code Server — Browser IDE
  code-server:
    build:
      context: .
      dockerfile: Dockerfile.code-server
    container_name: code-server-changemaker
    command: /home/coder/project
    environment:
      - DOCKER_USER=${USER_NAME:-coder}
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    volumes:
      - ./configs/code-server/.config:/home/coder/.config
      - ./configs/code-server/.local:/home/coder/.local
      - .:/home/coder/project
    ports:
      - "${CODE_SERVER_PORT:-8888}:8080"
    restart: unless-stopped
    networks:
      - changemaker-lite

  # MkDocs — Live documentation preview
  mkdocs:
    image: squidfunk/mkdocs-material
    container_name: mkdocs-changemaker
    volumes:
      - ./mkdocs:/docs:rw
      - ./assets/images:/docs/assets/images:rw
    user: "${USER_ID:-1000}:${GROUP_ID:-1000}"
    ports:
      - "${MKDOCS_PORT:-4003}:8000"
    environment:
      - SITE_URL=${BASE_DOMAIN:-https://cmlite.org}
      - ADMIN_PORT=${ADMIN_PORT:-3000}
      - ADMIN_URL=${ADMIN_URL:-}
      - MEDIA_API_PUBLIC_URL=${MEDIA_API_PUBLIC_URL:-http://localhost:4100}
      - MEDIA_API_PORT=${MEDIA_API_PORT:-4100}
      - BASE_DOMAIN=${BASE_DOMAIN:-}
    command: serve --dev-addr=0.0.0.0:8000 --watch-theme --livereload
    restart: unless-stopped
    networks:
      - changemaker-lite

  # MkDocs built site — Nginx static server
  mkdocs-site-server:
    image: lscr.io/linuxserver/nginx:latest
    container_name: mkdocs-site-server-changemaker
    environment:
      - PUID=${USER_ID:-1000}
      - PGID=${GROUP_ID:-1000}
      - TZ=Etc/UTC
    volumes:
      - ./mkdocs/site:/config/www
      - ./configs/mkdocs-site/default.conf:/config/nginx/site-confs/default.conf
    ports:
      - "${MKDOCS_SITE_SERVER_PORT:-4004}:80"
    restart: unless-stopped
    networks:
      - changemaker-lite

  # n8n — Workflow automation
  n8n:
    image: docker.n8n.io/n8nio/n8n
    container_name: n8n-changemaker
    restart: unless-stopped
    ports:
      - "${N8N_PORT:-5678}:5678"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:5678/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    environment:
      - N8N_HOST=${N8N_HOST:-n8n.cmlite.org}
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - NODE_ENV=production
      - WEBHOOK_URL=https://${N8N_HOST:-n8n.cmlite.org}/
      - GENERIC_TIMEZONE=${GENERIC_TIMEZONE:-UTC}
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY:-changeMe}
      - N8N_USER_MANAGEMENT_DISABLED=false
      - N8N_DEFAULT_USER_EMAIL=${N8N_USER_EMAIL:-admin@example.com}
      - N8N_DEFAULT_USER_PASSWORD=${N8N_USER_PASSWORD:-changeMe}
    volumes:
      - n8n-data:/home/node/.n8n
      - ./local-files:/files
    networks:
      - changemaker-lite

  # Homepage dashboard
  homepage:
    image: ghcr.io/gethomepage/homepage:latest
    container_name: homepage-changemaker
    ports:
      - "${HOMEPAGE_PORT:-3010}:3000"
    volumes:
      - ./configs/homepage:/app/config
      - ./assets/icons:/app/public/icons
      - ./assets/images:/app/public/images
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - PUID=${USER_ID:-1000}
      - PGID=${DOCKER_GROUP_ID:-984}
      - TZ=Etc/UTC
      - HOMEPAGE_ALLOWED_HOSTS=*
      - HOMEPAGE_VAR_BASE_URL=${HOMEPAGE_VAR_BASE_URL:-http://localhost}
    restart: unless-stopped
    networks:
      - changemaker-lite

  # Gitea — Git hosting
  gitea-app:
    image: gitea/gitea:1.23.7
    container_name: gitea-changemaker
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    environment:
      - USER_UID=${USER_ID:-1000}
      - USER_GID=${GROUP_ID:-1000}
      - GITEA__database__DB_TYPE=${GITEA_DB_TYPE:-mysql}
      - GITEA__database__HOST=${GITEA_DB_HOST:-gitea-db:3306}
      - GITEA__database__NAME=${GITEA_DB_NAME:-gitea}
      - GITEA__database__USER=${GITEA_DB_USER:-gitea}
      - GITEA__database__PASSWD=${GITEA_DB_PASSWD}
      - GITEA__server__ROOT_URL=${GITEA_ROOT_URL}
      - GITEA__server__HTTP_PORT=3000
      - GITEA__server__PROTOCOL=http
      - GITEA__server__DOMAIN=${GITEA_DOMAIN}
      - GITEA__server__ENABLE_GZIP=true
      - GITEA__server__X_FRAME_OPTIONS=
      # Increase upload limits for large pushes
      - GITEA__server__LFS_MAX_FILE_SIZE=1024
      - GITEA__repository__upload__FILE_MAX_SIZE=1024
      - GITEA__repository__upload__MAX_FILES=1000
    restart: unless-stopped
    volumes:
      - gitea-data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "${GITEA_WEB_PORT:-3030}:3000"
      - "${GITEA_SSH_PORT:-2222}:22"
    depends_on:
      - gitea-db
    networks:
      - changemaker-lite

  gitea-db:
    image: mysql:8
    container_name: gitea-mysql
    restart: unless-stopped
    environment:
      - MYSQL_ROOT_PASSWORD=${GITEA_DB_ROOT_PASSWORD}
      - MYSQL_USER=${GITEA_DB_USER:-gitea}
      - MYSQL_PASSWORD=${GITEA_DB_PASSWD}
      - MYSQL_DATABASE=${GITEA_DB_NAME:-gitea}
    volumes:
      - mysql-data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "${GITEA_DB_USER:-gitea}", "-p${GITEA_DB_PASSWD}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - changemaker-lite

  # Mini QR — QR code generator
  mini-qr:
    image: ghcr.io/lyqht/mini-qr:latest
    container_name: mini-qr
    ports:
      - "${MINI_QR_PORT:-8089}:8080"
    restart: unless-stopped
    networks:
      - changemaker-lite

  # Excalidraw — Collaborative whiteboard
  excalidraw:
    image: kiliandeca/excalidraw:latest
    container_name: excalidraw-changemaker
    restart: unless-stopped
    ports:
      - "${EXCALIDRAW_PORT:-8090}:80"
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:80/"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    environment:
      - VITE_APP_COLLAB_SERVER_URL=${EXCALIDRAW_WS_URL:-wss://draw.cmlite.org}
    networks:
      - changemaker-lite

  # MailHog — Email testing (dev)
  mailhog:
    image: mailhog/mailhog:latest
    container_name: mailhog-changemaker
    ports:
      - "${MAILHOG_WEB_PORT:-8025}:8025"
    # SMTP port 1025 is only exposed on the Docker network (containers connect via mailhog-changemaker:1025)
    restart: unless-stopped
    networks:
      - changemaker-lite
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "2"

  # =========================================================================
  # TUNNEL (Pangolin Newt connector)
  # =========================================================================

  # Newt — Pangolin tunnel connector (connects to Pangolin server)
  newt:
    image: fosrl/newt
    container_name: newt-changemaker
    restart: unless-stopped
    environment:
      - PANGOLIN_ENDPOINT=${PANGOLIN_ENDPOINT}
      - NEWT_ID=${PANGOLIN_NEWT_ID}
      - NEWT_SECRET=${PANGOLIN_NEWT_SECRET}
    depends_on:
      - nginx
    networks:
      - changemaker-lite

  # =========================================================================
  # MONITORING (behind profile flag)
  # =========================================================================

  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus-changemaker
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=30d'
    ports:
      - "${PROMETHEUS_PORT:-9090}:9090"
    volumes:
      - ./configs/prometheus:/etc/prometheus
      - prometheus-data:/prometheus
    restart: always
    networks:
      - changemaker-lite
    profiles:
      - monitoring

  grafana:
    image: grafana/grafana:latest
    container_name: grafana-changemaker
    ports:
      - "${GRAFANA_PORT:-3001}:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-admin}
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_SERVER_ROOT_URL=${GRAFANA_ROOT_URL:-http://localhost:3001}
      - GF_SECURITY_ALLOW_EMBEDDING=true
    volumes:
      - grafana-data:/var/lib/grafana
      - ./configs/grafana:/etc/grafana/provisioning
    restart: always
    depends_on:
      - prometheus
    networks:
      - changemaker-lite
    profiles:
      - monitoring

  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    container_name: cadvisor-changemaker
    ports:
      - "${CADVISOR_PORT:-8080}:8080"
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
      - /dev/disk/:/dev/disk:ro
    privileged: true
    devices:
      - /dev/kmsg
    restart: always
    networks:
      - changemaker-lite
    profiles:
      - monitoring

  node-exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter-changemaker
    ports:
      - "${NODE_EXPORTER_PORT:-9100}:9100"
    command:
      - '--path.rootfs=/host'
      - '--path.procfs=/host/proc'
      - '--path.sysfs=/host/sys'
      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
    volumes:
      - /proc:/host/proc:ro
      - /sys:/host/sys:ro
      - /:/rootfs:ro
    restart: always
    networks:
      - changemaker-lite
    profiles:
      - monitoring

  redis-exporter:
    image: oliver006/redis_exporter:latest
    container_name: redis-exporter-changemaker
    ports:
      - "${REDIS_EXPORTER_PORT:-9121}:9121"
    environment:
      - REDIS_ADDR=redis:6379
    restart: always
    depends_on:
      - redis
    networks:
      - changemaker-lite
    profiles:
      - monitoring

  alertmanager:
    image: prom/alertmanager:latest
    container_name: alertmanager-changemaker
    ports:
      - "${ALERTMANAGER_PORT:-9093}:9093"
    volumes:
      - ./configs/alertmanager:/etc/alertmanager
      - alertmanager-data:/alertmanager
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yml'
      - '--storage.path=/alertmanager'
    restart: always
    networks:
      - changemaker-lite
    profiles:
      - monitoring

  gotify:
    image: gotify/server:latest
    container_name: gotify-changemaker
    ports:
      - "${GOTIFY_PORT:-8889}:80"
    environment:
      - GOTIFY_DEFAULTUSER_NAME=${GOTIFY_ADMIN_USER:-admin}
      - GOTIFY_DEFAULTUSER_PASS=${GOTIFY_ADMIN_PASSWORD:-admin}
      - TZ=Etc/UTC
    volumes:
      - gotify-data:/app/data
    restart: always
    networks:
      - changemaker-lite
    profiles:
      - monitoring

# =============================================================================
# NETWORKS & VOLUMES
# =============================================================================

networks:
  changemaker-lite:
    driver: bridge

volumes:
  # v2
  v2-postgres-data:
  nocodb-v2-data:
  # Shared
  redis-data:
  listmonk-data:
  # Platform
  n8n-data:
  gitea-data:
  mysql-data:
  # Monitoring
  prometheus-data:
  grafana-data:
  alertmanager-data:
  gotify-data: