services:
  mysql:
    # Host CPU lacks x86-64-v2 (no SSE4.2); MySQL 8.x official images crash with glibc fatal.
    image: mysql:5.7
    container_name: badi-pwa-mysql
    restart: unless-stopped
    env_file:
      - .env.mysql
    # Do NOT publish 3306 — public MySQL is a common ransomware target (RECOVER_YOUR_DATA).
    # Backend reaches MySQL via the internal Docker network only.
    volumes:
      - badi_pwa_mysql_data:/var/lib/mysql
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h127.0.0.1 -uroot -p$$MYSQL_ROOT_PASSWORD || exit 1"]
      interval: 5s
      timeout: 5s
      retries: 20

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
      network: host
      args:
        # HTTP forwarder (gost) → host SOCKS 127.0.0.1:1081 — Prisma needs HTTP proxy
        HTTP_PROXY: http://127.0.0.1:8118
        HTTPS_PROXY: http://127.0.0.1:8118
        ALL_PROXY: http://127.0.0.1:8118
    image: badi-pwa-backend:latest
    container_name: badi-pwa-backend
    ports:
      - "3001:3001"
    restart: unless-stopped
    env_file:
      - ./backend/.env
    environment:
      - NODE_ENV=production
      - PORT=3001
      - HOST=0.0.0.0
      # DATABASE_URL comes from backend/.env (do not hardcode credentials here)
      - CORS_ORIGIN=https://pwa.feep.ir,https://novya.ir
      - TRUST_PROXY=true
    depends_on:
      mysql:
        condition: service_healthy

  app:
    build:
      context: .
      dockerfile: Dockerfile
      network: host
      args:
        HTTP_PROXY: http://127.0.0.1:8118
        HTTPS_PROXY: http://127.0.0.1:8118
        ALL_PROXY: http://127.0.0.1:8118
    image: badi-pwa-app:latest
    container_name: badi-pwa-app
    ports:
      - "3020:80"
    restart: unless-stopped
    environment:
      - NODE_ENV=production
    depends_on:
      - backend

volumes:
  badi_pwa_mysql_data: