# ---------------------------------------------------------------------------
# Docker Compose for Cybersecurity Panel
#
# Default (`docker compose up --build`): production-shaped single container
# (same as HuggingFace Spaces). Port host 7861 → container 7860.
#
# Dev with hot reload:
#   docker compose --profile dev up --build
# Backend: uvicorn --reload on :8000
# Frontend: CRA npm start on :3000 (REACT_APP_API_URL=http://localhost:8000)
#
# Secrets: prefer C:\Users\dream\.secrets\shared.env (mounted / copied via
# env_file). Override with a local .env as needed.
#
# Image/container naming follows: <repo>-<branch>-<date>
# ---------------------------------------------------------------------------

x-shared-env: &shared-env
  # Non-secret defaults only. API keys / JWT come from env_file
  # (C:/Users/dream/.secrets/shared.env) — do NOT set OPENAI_API_KEY /
  # VLLM_API_KEY here with ${VAR:-} or an empty host env will blank the
  # values that env_file already injected.
  GEMINI_MODEL: ${GEMINI_MODEL:-gemini-2.5-flash}
  CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:3000,http://127.0.0.1:3000}

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    image: cybersecurity-panel-dev-cursor-${COMPOSE_DATE:-local}
    container_name: cybersecurity-panel-dev-cursor-${COMPOSE_DATE:-local}
    ports:
      - "${CYBERPANEL_HOST_PORT:-7861}:7860"
    env_file:
      - path: ${SHARED_ENV_FILE:-C:/Users/dream/.secrets/shared.env}
        required: false
      - path: .env
        required: false
    environment:
      <<: *shared-env
      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-CHANGEME-by-overriding-in-dot-env-file}
      CONFIG_PATH: ${CONFIG_PATH:-/home/user/app/cybersecurity_config.yaml}
      CORS_ORIGINS: ${CORS_ORIGINS:-*}
      DATA_DIR: /data
    volumes:
      - cybersecurity_data:/data

  backend:
    profiles: ["dev"]
    build:
      context: .
      dockerfile: Dockerfile.dev
      target: backend
    image: cybersecurity-panel-backend-dev-cursor-${COMPOSE_DATE:-local}
    container_name: cybersecurity-panel-backend-dev-cursor-${COMPOSE_DATE:-local}
    ports:
      - "${BACKEND_HOST_PORT:-8000}:8000"
    env_file:
      - path: ${SHARED_ENV_FILE:-C:/Users/dream/.secrets/shared.env}
        required: false
      - path: .env
        required: false
    environment:
      <<: *shared-env
      CONFIG_PATH: /app/cybersecurity_config.yaml
      DATA_DIR: /data
      PYTHONPATH: /app/multi_llm_chatbot_backend
      # Keep a host-readable copy of shared.env for _load_shared_env_var fallback
      SHARED_ENV: /run/secrets/shared.env
    volumes:
      - ./multi_llm_chatbot_backend:/app/multi_llm_chatbot_backend
      - ./cybersecurity_config.yaml:/app/cybersecurity_config.yaml:ro
      - ./personas:/app/personas:ro
      - ./tracks:/app/tracks:ro
      - cybersecurity_data:/data
      - type: bind
        source: ${SHARED_ENV_FILE:-C:/Users/dream/.secrets/shared.env}
        target: /run/secrets/shared.env
        read_only: true
    command:
      [
        "uvicorn",
        "app.main:app",
        "--host",
        "0.0.0.0",
        "--port",
        "8000",
        "--reload",
        "--reload-dir",
        "/app/multi_llm_chatbot_backend/app",
      ]

  frontend:
    profiles: ["dev"]
    build:
      context: .
      dockerfile: Dockerfile.dev
      target: frontend
    image: cybersecurity-panel-frontend-dev-cursor-${COMPOSE_DATE:-local}
    container_name: cybersecurity-panel-frontend-dev-cursor-${COMPOSE_DATE:-local}
    ports:
      - "${FRONTEND_HOST_PORT:-3000}:3000"
    environment:
      REACT_APP_API_URL: ${REACT_APP_API_URL:-http://localhost:8000}
      CHOKIDAR_USEPOLLING: "true"
      WATCHPACK_POLLING: "true"
    volumes:
      - ./frontend:/app
      - frontend_node_modules:/app/node_modules
    depends_on:
      - backend
    command: ["npm", "start"]

volumes:
  cybersecurity_data:
  frontend_node_modules: