name: smgw-pki

services:
  backend:
    image: smgw-pki-automator:dev
    build:
      context: ../backend
      dockerfile: Dockerfile
    container_name: smgw-pki-automator
    environment:
      RUST_LOG: ${RUST_LOG:-info,smgw_pki_automator=debug}
      BIND_ADDR: 0.0.0.0:8443
      CRON_SCHEDULE: ${CRON_SCHEDULE:-0 0 3 * * *}
      DAYS_WINDOW: ${DAYS_WINDOW:-30}
      DATABASE_URL: ${DATABASE_URL:-sqlite:///data/smgw.db?mode=rwc}
      CORS_ALLOW_ORIGIN: ${CORS_ALLOW_ORIGIN:-http://localhost:8080}
      DEV_AUTH: ${DEV_AUTH:-1}
      SUB_CA_ENDPOINT: ${SUB_CA_ENDPOINT:-https://test-ca.local/soap}
      HSM_MODULE: ${HSM_MODULE:-/usr/lib/softhsm/libsofthsm2.so}
    volumes:
      - backend_data:/data
      - softhsm_tokens:/var/lib/softhsm/tokens
    expose:
      - "8443"
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8443/health"]
      interval: 5s
      timeout: 3s
      retries: 10
      start_period: 10s

  frontend:
    image: smgw-pki-console:dev
    build:
      context: ../frontend
      dockerfile: Dockerfile
    container_name: smgw-pki-console
    depends_on:
      backend:
        condition: service_healthy
    ports:
      - "${WEB_PORT:-8080}:80"
    volumes:
      # nginx.conf lives next to compose.yaml so ops can iterate without
      # rebuilding the frontend image. Reload via `just nginx-reload`.
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro

volumes:
  backend_data:
  softhsm_tokens: