services:
  norish:
    image: norishapp/norish:latest
    container_name: norish-app
    # user: "1000:1000"  # Match your host user's UID:GID (run `id` to check), only needed with bind mounts
    # The example uses named volume 'norish_data' which handles permissions automatically
    restart: always # Required for server restart functionality
    ports:
      - "3000:3000"
    user: "1000:1000"
    volumes:
      - norish_data:/app/uploads
    environment:
      # Core settings (required)
      AUTH_URL: http://ddocker3.maison:3000
      DATABASE_URL: postgres://postgres:norish@db:5432/norish
      MASTER_KEY: 3NA734BBUitXp4DGvhq/3pUQL5Ai11DODLP6TW/TSo4= # Generate with: openssl rand -base64 32
      CHROME_WS_ENDPOINT: ws://chrome-headless:3000
      REDIS_URL: redis://redis:6379

      # OPTIONAL
      # NEXT_PUBLIC_LOG_LEVEL: info       # trace, debug, info, warn, error, fatal (default: info in prod, debug in dev)
      # TRUSTED_ORIGINS:http://192.168.1.100:3000,https://norish.example.com  # Additional trusted origins, comma separated. Useful when behind a proxy or using multiple domains.
      # YT_DLP_BIN_DIR: # Custom folder path for `yt-dlp` (default: /app/bin)

      # ─────────────────────────────────────────────────────────────────────────
      # FIRST USER SETUP
      # ─────────────────────────────────────────────────────────────────────────
      # On first startup, configure ONE auth provider below to create your admin account.
      # After first login, use Settings → Admin to configure additional providers,
      # AI settings, video parsing, and all other options.

      # Option 1= Password auth - basic auth with email/password
      # If not set defaults to disabled if OIDC or OAuth is configured.
      # Defaults to true if no other auth providers are configured.
      PASSWORD_AUTH_ENABLED: true

      # Option 2: OIDC (Authentik, Keycloak, PocketID, etc.)
      # OIDC_NAME: NoraId
      # OIDC_ISSUER: https://nora.example.com
      # OIDC_CLIENT_ID: <client-id>
      # OIDC_CLIENT_SECRET: <client-secret>
      # OIDC_WELLKNOWN: https://auth.example.com/.well-known/openid-configuration
      # Wellknown is optional: By default the wellknown URL is derived from the issuer by appending /.well-known/openid-configuration

      # Option 3: GitHub OAuth (uncomment and remove OIDC above)
      # GITHUB_CLIENT_ID: <github-client-id>
      # GITHUB_CLIENT_SECRET: <github-client-secret>

      # Option 4: Google OAuth (uncomment and remove OIDC above)
      # GOOGLE_CLIENT_ID: <google-client-id>
      # GOOGLE_CLIENT_SECRET: <google-client-secret>
    depends_on:
      - db
      - redis

  db:
    image: postgres:17-alpine
    container_name: norish-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: norish
      POSTGRES_DB: norish
    volumes:
      - db_data:/var/lib/postgresql/data

  # Chrome headless
  chrome-headless:
    image: zenika/alpine-chrome:latest
    container_name: chrome-headless
    restart: unless-stopped
    command:
      - "--no-sandbox"
      - "--disable-gpu"
      - "--disable-dev-shm-usage"
      - "--remote-debugging-address=0.0.0.0"
      - "--remote-debugging-port=3000"
      - "--headless"

  # Redis for real-time events and job queues
  redis:
    image: redis:8.4.0
    container_name: norish-redis
    restart: unless-stopped
    volumes:
      - redis_data:/data

volumes:
  db_data:
  norish_data:
  redis_data: