x-environment: &shared-environment
  # ---- APP -------
  VERSION: ${VERSION}
  APP_NAME: ${APP_NAME}
  APP_ENV: ${APP_ENV:-development}
  NODE_ENV: ${APP_ENV:-development}
  HOST: ${HOST}
  VERIFY_EMAIL_ENABLED: ${VERIFY_EMAIL_ENABLED:-false}

  # ---- REDIS ----
  REDIS_HOST: ${REDIS_HOST:-redis}
  REDIS_PORT: ${REDIS_PORT:-6379}

  # ---- PGBOUNCER ----
  PGBOUNCER_HOST: ${PGBOUNCER_HOST:-pgbouncer}
  PGBOUNCER_PORT: ${PGBOUNCER_PORT:-6432}
  EXPOSE_PGBOUNCER_PORT: ${EXPOSE_PGBOUNCER_PORT:-6432}

  # ---- DATABASE ----
  DB_TYPE: ${DB_TYPE}
  DB_HOST: postgres
  DB_PORT: ${DB_PORT:-5432}
  DB_NAME_SERVER: server
  DB_USER_SERVER: app_user
  POSTGRES_USER: postgres

  # ---- LOGGING ----
  LOG_LEVEL: ${LOG_LEVEL:-INFO}
  LOG_IS_FORMAT_JSON: ${LOG_IS_FORMAT_JSON:-false}
  LOG_IS_FULL_DETAILS: ${LOG_IS_FULL_DETAILS:-false}
  LOG_ENABLED_FILE_LOGGING: ${LOG_ENABLED_FILE_LOGGING}
  LOG_DIR_PATH: ${LOG_DIR_PATH}
  LOG_ENABLED_EXTERNAL_LOGGING: ${LOG_ENABLED_EXTERNAL_LOGGING}
  LOG_EXTERNAL_HTTP_HOST: ${LOG_EXTERNAL_HTTP_HOST}
  LOG_EXTERNAL_HTTP_PORT: ${LOG_EXTERNAL_HTTP_PORT}
  LOG_EXTERNAL_HTTP_PATH: ${LOG_EXTERNAL_HTTP_PATH}
  LOG_EXTERNAL_HTTP_LEVEL: ${LOG_EXTERNAL_HTTP_LEVEL}
  LOG_EXTERNAL_HTTP_TOKEN: ${LOG_EXTERNAL_HTTP_TOKEN}

  # ---- HOCUSPOCUS ----
  HOCUSPOCUS_PORT: ${HOCUSPOCUS_PORT}
  HOCUSPOCUS_URL: ${HOCUSPOCUS_URL}

  # ---- EMAIL ----
  EMAIL_ENABLE: ${EMAIL_ENABLE:-false}
  EMAIL_FROM: ${EMAIL_FROM:-noreply@example.com}
  EMAIL_HOST: ${EMAIL_HOST}
  EMAIL_PORT: ${EMAIL_PORT:-587}
  EMAIL_USERNAME: ${EMAIL_USERNAME:-noreply@example.com}

  # ---- CRYPTO ----
  CRYPTO_SALT_BYTES: ${SALT_BYTES}
  CRYPTO_ITERATION: ${ITERATION}
  CRYPTO_KEY_LENGTH: ${KEY_LENGTH}
  CRYPTO_ALGORITHM: ${ALGORITHM}

  # ---- TOKEN ----
  TOKEN_EXPIRES: ${TOKEN_EXPIRES}

  # ---- AI / LLM ----
  OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
  OPENROUTER_API: ${OPENROUTER_API:-}

  # ---- AUTH ----
  NEXTAUTH_URL: ${NEXTAUTH_URL:-http://localhost:3000}
  # Required by edge-auth (read from env, not Docker secret file)
  NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}
  NEXTAUTH_SESSION_EXPIRES: ${NEXTAUTH_SESSION_EXPIRES:-86400}
  AUTH_TRUST_HOST: ${AUTH_TRUST_HOST:-false}

  # ---- DEPLOY INFO  ----
  PROJECT_NAME: ${PROJECT_NAME}
  EXPOSE_DB_PORT: ${EXPOSE_DB_PORT:-5432}
  EXPOSE_HOCUSPOCUS_PORT: ${EXPOSE_HOCUSPOCUS_PORT:-1234}
  EXPOSE_REDIS_PORT: ${EXPOSE_REDIS_PORT:-6379}
  EXPOSE_SERVER_PORT: ${EXPOSE_SERVER_PORT:-3000}

secrets:
  db_password_server:
    file: ./secrets/db_password_server
  db_password_hocuspocus:
    file: ./secrets/db_password_hocuspocus
  postgres_password:
    file: ./secrets/postgres_password
  redis_password:
    file: ./secrets/redis_password
  email_password:
    file: ./secrets/email_password
  crypto_key:
    file: ./secrets/crypto_key
  token_secret_key:
    file: ./secrets/token_secret_key
  nextauth_secret:
    file: ./secrets/nextauth_secret
  google_oauth_client_id:
    file: ./secrets/google_oauth_client_id
  google_oauth_client_secret:
    file: ./secrets/google_oauth_client_secret
  alga_auth_key:
    file: ./secrets/alga_auth_key
  ninjaone_client_id:
    file: ./secrets/ninjaone_client_id
  ninjaone_client_secret:
    file: ./secrets/ninjaone_client_secret

services:
  postgres: # Renamed from postgres-base
    image: pgvector-clean:0.8.0-pg15
    #container_name: ${APP_NAME:-sebastian}_postgres
    command: postgres -c password_encryption=md5
    environment:
      <<: *shared-environment
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_password
      POSTGRES_INITDB_ARGS: "--auth-host=md5 --auth-local=md5"
    secrets:
      - postgres_password
    ports:
      - "${EXPOSE_DB_PORT:-5432}:5432"
    networks:
      - app-network

  redis: # Renamed from redis-base
    build:
      context: .
      dockerfile: redis/Dockerfile
    #container_name: ${APP_NAME:-sebastian}_redis
    environment:
      <<: *shared-environment
    ports:
      - '${EXPOSE_REDIS_PORT:-6379}:6379'
    secrets:
      - redis_password
    networks:
      - app-network
  pgbouncer:
    extends:
      file: ./pgbouncer/docker-compose.yaml
      service: pgbouncer
    environment:
      <<: *shared-environment
    secrets:
      - postgres_password
      - db_password_server
    networks:
      - app-network
    depends_on:
      postgres: # Corrected to match the renamed service name
        condition: service_started

networks:
  app-network:
    driver: bridge