version: '3.8'

services:
  didi-framework:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: didi-framework
    # Bound on VLAN 10 IP for Kong cluster (kong-cp.local/177/178) reachability.
    # Internal traffic (other DIDI containers) still uses didi-network DNS.
    ports:
      - "3005:3005"
    environment:
      - NODE_ENV=production
      - PORT=3005
      - HOST=0.0.0.0
      - DB_HOST=${DB_HOST:-didi-postgres}
      - DB_PORT=${DB_PORT:-5432}
      - DB_NAME=${DB_NAME:-DIDI}
      - DB_USER=${DB_USER:-bos_interface}
      - DB_PASSWORD=${DB_PASSWORD:-interface}
      - DB_SCHEMA=bos_parammgmt
      - CORS_ORIGIN=*
      - REDIS_HOST=${REDIS_HOST:-didi-cache}
      - REDIS_PORT=${REDIS_PORT:-6379}
      - REDIS_USERNAME=${REDIS_USERNAME:-}
      - REDIS_PASSWORD=${REDIS_PASSWORD:-redis123}
      - REDIS_DB=${REDIS_DB:-0}
      - MINIO_ENDPOINT=${MINIO_ENDPOINT:-staging-dataLayer-minio}
      - MINIO_PORT=${MINIO_PORT:-9000}
      - MINIO_USE_SSL=${MINIO_USE_SSL:-false}
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY:-minioadmin}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY:-minio123}
      - MINIO_BUCKET=${MINIO_BUCKET:-}
      - MINIO_PUBLIC_URL=${MINIO_PUBLIC_URL:-http://localhost:27000}
      # Keycloak — local didi-keycloak on didi-network (didi11 fully self-contained).
      # Base URL MUST include /auth (KC_HTTP_RELATIVE_PATH) — admin API + JWKS 404 without it.
      - KEYCLOAK_URL=${KEYCLOAK_URL:-http://didi-keycloak:8080/auth}
      - KEYCLOAK_ADMIN=${KEYCLOAK_ADMIN:-admin}
      - KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_ADMIN_PASSWORD:-admin123}
      # JWT signature gate — set to 'false' ONLY for local dev without Keycloak
      - JWT_VERIFY_ENABLED=${JWT_VERIFY_ENABLED:-true}
      # Facebook Graph API — DESI 6 social posting din admin-dashboard
      - FACEBOOK_APP_ID=${FACEBOOK_APP_ID:-2102973493835328}
      - FACEBOOK_APP_SECRET=${FACEBOOK_APP_SECRET:-}
      - FACEBOOK_PAGE_ID=${FACEBOOK_PAGE_ID:-1152853237912005}
      - FACEBOOK_PAGE_ACCESS_TOKEN=${FACEBOOK_PAGE_ACCESS_TOKEN:-}
      - FACEBOOK_API_VERSION=${FACEBOOK_API_VERSION:-v21.0}
      # LinkedIn (postare automată pe profil/pagină — provider paralel cu Facebook)
      - LINKEDIN_ACCESS_TOKEN=${LINKEDIN_ACCESS_TOKEN:-}
      - LINKEDIN_ORG_URN=${LINKEDIN_ORG_URN:-}
      - LINKEDIN_API_VERSION=${LINKEDIN_API_VERSION:-202506}
      # Stripe (test mode keys come from .env file)
      - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY:-}
      - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET:-}
      - STRIPE_PUBLISHABLE_KEY=${STRIPE_PUBLISHABLE_KEY:-}
      # SMTP (transactional email — finesynergy)
      - SMTP_HOST=${SMTP_HOST:-}
      - SMTP_PORT=${SMTP_PORT:-465}
      - SMTP_SECURE=${SMTP_SECURE:-true}
      - SMTP_USER=${SMTP_USER:-}
      - SMTP_PASS=${SMTP_PASS:-}
      - SMTP_FROM_NAME=${SMTP_FROM_NAME:-DIDI}
      - SMTP_FROM_EMAIL=${SMTP_FROM_EMAIL:-}
      - PUBLIC_APP_URL=${PUBLIC_APP_URL:-https://api.local:8443}
      # OTel — traces to Jaeger via OTel Collector
      - OTEL_ENABLED=${OTEL_ENABLED:-true}
      - OTEL_EXPORTER_OTLP_ENDPOINT=${OTEL_EXPORTER_OTLP_ENDPOINT:-http://didi-otel-collector:4318/v1/traces}
      - OTEL_SERVICE_NAME=didi-framework
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - didi-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3005/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

networks:
  didi-network:
    external: true