services:
  postgres:
    image: postgres:16
    container_name: satellite-provider-postgres
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: satelliteprovider
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 5

  api:
    build:
      context: .
      dockerfile: SatelliteProvider.Api/Dockerfile
    container_name: satellite-provider-api
    ports:
      - "18980:8080"
      - "18981:8081"
    # AZ-505 AC-5: HTTPS is required for HTTP/2 via ALPN (Kestrel silently
    # disables HTTP/2 on plaintext endpoints). The cert is self-signed,
    # dev-only — generated by scripts/run-tests.sh and gitignored under
    # ./certs/. The integration-tests container installs the matching
    # public cert into its OS CA store so every HttpClient trusts it.
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - ASPNETCORE_URLS=https://+:8080
      - ASPNETCORE_Kestrel__Certificates__Default__Path=/app/certs/api.pfx
      - ASPNETCORE_Kestrel__Certificates__Default__Password=satellite-dev-cert
      - ConnectionStrings__DefaultConnection=Host=postgres;Port=5432;Database=satelliteprovider;Username=postgres;Password=postgres
      - MapConfig__ApiKey=${GOOGLE_MAPS_API_KEY}
      - JWT_SECRET=${JWT_SECRET}
      - JWT_ISSUER=${JWT_ISSUER}
      - JWT_AUDIENCE=${JWT_AUDIENCE}
    volumes:
      - ./tiles:/app/tiles
      - ./ready:/app/ready
      - ./logs:/app/logs
      - ./certs/api.pfx:/app/certs/api.pfx:ro
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  postgres_data: