# ──────────────────────────────────────────────────────────────
#  BanGUI — Debug / Development Compose
#
#  Compatible with:
#    docker compose -f Docker/compose.debug.yml up
#    podman compose  -f Docker/compose.debug.yml up
#    podman-compose  -f Docker/compose.debug.yml up
#
#  Features:
#    - Source code mounted as volumes (hot-reload)
#    - Uvicorn --reload for backend auto-restart
#    - Vite dev server for frontend with HMR
#    - Ports exposed on host for direct access
#    - Debug log level enabled
# ──────────────────────────────────────────────────────────────

name: bangui-dev

services:
  # ── fail2ban ─────────────────────────────────────────────────
  fail2ban:
    image: lscr.io/linuxserver/fail2ban:latest
    container_name: bangui-fail2ban-dev
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - NET_RAW
    network_mode: host
    environment:
      TZ: "${BANGUI_TIMEZONE:-UTC}"
      PUID: 0
      PGID: 0
    volumes:
      - ../data/fail2ban-dev-config:/config
      - fail2ban-dev-run:/var/run/fail2ban
      - /var/log:/var/log:ro
      - ../data/log:/remotelogs/bangui
    healthcheck:
      test: ["CMD", "fail2ban-client", "ping"]
      interval: 15s
      timeout: 5s
      start_period: 15s
      retries: 3

  # ── Backend (FastAPI + uvicorn with --reload) ───────────────
  backend:
    build:
      context: ..
      dockerfile: Docker/Dockerfile.backend
      target: runtime
    container_name: bangui-backend-dev
    restart: unless-stopped
    user: "0"
    depends_on:
      fail2ban:
        condition: service_healthy
    environment:
      BANGUI_DATABASE_PATH: "/data/bangui.db"
      BANGUI_FAIL2BAN_SOCKET: "/var/run/fail2ban/fail2ban.sock"
      BANGUI_FAIL2BAN_CONFIG_DIR: "/config/fail2ban"
      BANGUI_LOG_FILE: "/data/log/bangui.log"
      BANGUI_LOG_LEVEL: "debug"
      BANGUI_ENABLE_DOCS: "true"
      BANGUI_SESSION_SECRET: "${BANGUI_SESSION_SECRET:?BANGUI_SESSION_SECRET must be set — generate with: python -c 'import secrets; print(secrets.token_hex(32))'}"
      BANGUI_TIMEZONE: "${BANGUI_TIMEZONE:-UTC}"
      # Secure=false is intentional for local HTTP development.
      # In production, Secure=true prevents session cookies over unencrypted HTTP.
      BANGUI_SESSION_COOKIE_SECURE: "false"
      # BANGUI_WORKERS should not be set (defaults to 1).
      # Never set it to > 1; the session cache is process-local.
    volumes:
      - ../backend/app:/app/app:z
      - ../fail2ban-master:/app/fail2ban-master:ro,z
      - ../data:/data
      - fail2ban-dev-run:/var/run/fail2ban:ro
      - ../data/fail2ban-dev-config:/config:rw
    command:
      [
        "uvicorn", "app.main:create_app", "--factory",
        "--host", "0.0.0.0", "--port", "8000",
        "--reload", "--reload-dir", "/app/app"
      ]
    healthcheck:
      test: ["CMD-SHELL", "python -c 'import urllib.request; urllib.request.urlopen(\"http://127.0.0.1:8000/api/v1/health/live\", timeout=4)'"]
      interval: 15s
      timeout: 5s
      start_period: 45s
      retries: 5
    network_mode: host

  # ── Frontend (Vite dev server with HMR) ─────────────────────
  frontend:
    image: node:22-alpine
    container_name: bangui-frontend-dev
    restart: unless-stopped
    working_dir: /app
    environment:
      NODE_ENV: development
      VITE_BACKEND_URL: "http://localhost:8000"
    volumes:
      - ../frontend:/app:z
      - frontend-node-modules:/app/node_modules
    command: ["sh", "-c", "npm install && npm run dev -- --host 0.0.0.0"]
    depends_on:
      backend:
        condition: service_healthy
    network_mode: host

volumes:
  bangui-dev-data:
    driver: local
  frontend-node-modules:
    driver: local
  fail2ban-dev-run:
    driver: local

networks:
  bangui-dev-net:
    driver: bridge