services:
  coturn:
    image: coturn/coturn:4.6.3
    # Local development default. If camera/client are on other devices, replace 127.0.0.1
    # in TURN_URLS/VITE_TURN_URLS and --external-ip with the host machine's LAN IP.
    command:
      - -n
      - --log-file=stdout
      - --realm=securecam.local
      - --fingerprint
      - --lt-cred-mech
      - --user=securecam:securecamturn
      - --listening-port=3478
      - --listening-ip=0.0.0.0
      - --relay-ip=0.0.0.0
      - --external-ip=127.0.0.1
      - --min-port=49160
      - --max-port=49200
    ports:
      - "3478:3478"
      - "3478:3478/udp"
      - "49160-49200:49160-49200/udp"
    restart: unless-stopped

  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: securecam
      POSTGRES_USER: securecam
      POSTGRES_PASSWORD: securecam
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
      interval: 5s
      timeout: 5s
      retries: 10

  minio:
    image: minio/minio:latest
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: minioadmin
      MINIO_ROOT_PASSWORD: minioadmin
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - minio_data:/data

  backend:
    build:
      context: ./Backend
    working_dir: /app
    command: sh -c "bun install --frozen-lockfile && bun run db:migrate && bun run dev"
    environment:
      DATABASE_URL: postgres://securecam:securecam@postgres:5432/securecam
      BETTER_AUTH_SECRET: local-development-secret-change-me-123456789
      BETTER_AUTH_BASE_URL: http://localhost:3000
      BETTER_AUTH_TRUSTED_ORIGINS: http://localhost:5173
      PORT: 3000
      DEVICE_ONLINE_STALE_SECONDS: 30
      MINIO_ENDPOINT: minio
      MINIO_PORT: 9000
      MINIO_USE_SSL: "false"
      MINIO_ACCESS_KEY: minioadmin
      MINIO_SECRET_KEY: minioadmin
      MINIO_BUCKET: videos
      MINIO_REGION: us-east-1
      MINIO_PRESIGNED_EXPIRY_SECONDS: 600
      MINIO_TLS_REJECT_UNAUTHORIZED: "true"
      MINIO_INSECURE_SKIP_TLS_VERIFY: "false"
      MEDIA_MODE: legacy
      MEDIA_PROVIDER: mock
      MEDIA_RECORDINGS_DIR: media-recordings
      MEDIA_MAX_PUBLISHERS: 4
      MEDIA_MAX_SUBSCRIBERS_PER_ROOM: 12
      ADMIN_USERNAME: admin
      ADMIN_PASSWORD: strong-password
      TURN_URLS: turn:localhost:3478?transport=udp,turn:localhost:3478?transport=tcp
      TURN_USERNAME: securecam
      TURN_CREDENTIAL: securecamturn
    ports:
      - "3000:3000"
    volumes:
      - ./Backend:/app
      - backend_node_modules:/app/node_modules
      - backend_media_recordings:/app/media-recordings
    depends_on:
      postgres:
        condition: service_healthy
      minio:
        condition: service_started
      coturn:
        condition: service_started
    restart: unless-stopped

  webapp:
    build:
      context: ./WebApp
    working_dir: /app
    command: sh -c "npm install --no-fund --no-audit && npm run dev -- --host 0.0.0.0 --port 5173"
    environment:
      BACKEND_URL: http://backend:3000
      VITE_BACKEND_URL: http://localhost:3000
      VITE_STUN_URLS: stun:stun.l.google.com:19302
      VITE_TURN_URLS: turn:localhost:3478?transport=udp,turn:localhost:3478?transport=tcp
      VITE_TURN_USERNAME: securecam
      VITE_TURN_CREDENTIAL: securecamturn
    ports:
      - "5173:5173"
    volumes:
      - ./WebApp:/app
      - webapp_node_modules:/app/node_modules
    depends_on:
      - backend
      - coturn
    restart: unless-stopped

volumes:
  postgres_data:
  minio_data:
  backend_node_modules:
  backend_media_recordings:
  webapp_node_modules: