dashboard/docker-compose.yml

services:
  postgres:
    image: postgres:16-alpine
    container_name: feuerwehr_db_prod
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-feuerwehr_prod}
      POSTGRES_USER: ${POSTGRES_USER:-prod_user}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    volumes:
      - postgres_data_prod:/var/lib/postgresql/data
    networks:
      - dashboard-backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-prod_user} -d ${POSTGRES_DB:-feuerwehr_prod}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    restart: unless-stopped

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: feuerwehr_backend_prod
    environment:
      NODE_ENV: production
      PORT: 3000
      DB_HOST: postgres
      DB_PORT: 5432
      DB_NAME: ${POSTGRES_DB:-feuerwehr_prod}
      DB_USER: ${POSTGRES_USER:-prod_user}
      DB_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
      JWT_EXPIRES_IN: ${JWT_EXPIRES_IN:-24h}
      CORS_ORIGIN: ${CORS_ORIGIN:-https://portal.feuerwehr-rems.at}
      AUTHENTIK_ISSUER: ${AUTHENTIK_ISSUER:?AUTHENTIK_ISSUER is required}
      AUTHENTIK_CLIENT_ID: ${AUTHENTIK_CLIENT_ID:?AUTHENTIK_CLIENT_ID is required}
      AUTHENTIK_CLIENT_SECRET: ${AUTHENTIK_CLIENT_SECRET:?AUTHENTIK_CLIENT_SECRET is required}
      AUTHENTIK_REDIRECT_URI: ${AUTHENTIK_REDIRECT_URI:-https://portal.feuerwehr-rems.at/auth/callback}
      NEXTCLOUD_URL: ${NEXTCLOUD_URL:-https://cloud.feuerwehr-rems.at}
      ICAL_BASE_URL: ${ICAL_BASE_URL:-https://portal.feuerwehr-rems.at}
      BOOKSTACK_URL: ${BOOKSTACK_URL:-}
      BOOKSTACK_TOKEN_ID: ${BOOKSTACK_TOKEN_ID:-}
      BOOKSTACK_TOKEN_SECRET: ${BOOKSTACK_TOKEN_SECRET:-}
      FDISK_SYNC_URL: http://fdisk-sync:3001
    ports:
      - "${BACKEND_PORT:-3000}:3000"
    volumes:
      - ./uploads:/app/uploads
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - dashboard-backend
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    restart: unless-stopped

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        VITE_API_URL: ${VITE_API_URL:-https://portal.feuerwehr-rems.at}
        AUTHENTIK_URL: ${AUTHENTIK_URL:?AUTHENTIK_URL is required}
        AUTHENTIK_CLIENT_ID: ${AUTHENTIK_CLIENT_ID:?AUTHENTIK_CLIENT_ID is required}
    container_name: feuerwehr_frontend_prod
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.feuerwehr-frontend.entrypoints=websecure"
      - "traefik.http.routers.feuerwehr-frontend.rule=Host(`portal.feuerwehr-rems.at`)"
      - "traefik.http.routers.feuerwehr-frontend.tls=true"
      - "traefik.http.routers.feuerwehr-frontend.tls.certresolver=letsencrypt"
      - "traefik.http.routers.feuerwehr-frontend.service=feuerwehr-frontend"
      - "traefik.http.services.feuerwehr-frontend.loadbalancer.server.port=80"
      - "traefik.docker.network=frontend"
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - frontend
      - dashboard-backend
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:80"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    restart: unless-stopped

  fdisk-sync:
    build:
      context: ./sync
      dockerfile: Dockerfile
    container_name: feuerwehr_fdisk_sync
    environment:
      FDISK_USERNAME: ${FDISK_USERNAME:?FDISK_USERNAME is required}
      FDISK_PASSWORD: ${FDISK_PASSWORD:?FDISK_PASSWORD is required}
      FDISK_ID_FEUERWEHREN: ${FDISK_ID_FEUERWEHREN:-164}
      FDISK_ID_INSTANZEN: ${FDISK_ID_INSTANZEN:-2853}
      DB_HOST: postgres
      DB_PORT: 5432
      DB_NAME: ${POSTGRES_DB:-feuerwehr_prod}
      DB_USER: ${POSTGRES_USER:-prod_user}
      DB_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
      SYNC_HTTP_PORT: 3001
      FDISK_DEBUG_HTML: ${FDISK_DEBUG_HTML:-}
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - dashboard-backend
    restart: unless-stopped

volumes:
  postgres_data_prod:
    driver: local

networks:
  frontend:
    external: true
  dashboard-backend: