version: '3.8'

services:
  # Backend Service
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: it-nexus-backend
    restart: unless-stopped
    ports:
      - "5000:5000"
    environment:
      - NODE_ENV=production
      - PORT=5000
      - JWT_SECRET=${JWT_SECRET}
      - AGENT_API_KEY=${AGENT_API_KEY}
      - SCANNER_API_KEY=${SCANNER_API_KEY}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - TV_DASHBOARD_KEY=${TV_DASHBOARD_KEY}
      - JWT_EXPIRATION=8h
      - DATABASE_PATH=/app/data/database.sqlite
      - FRONTEND_URL=https://it-nexus.cereda-systems.de
      - BCRYPT_ROUNDS=12
      # SMTP (ausgehende E-Mails)
      - SMTP_HOST=smtp-mail.outlook.com
      - SMTP_PORT=587
      - SMTP_SECURE=false
      - SMTP_USER=it-tool@cereda-systems.de
      - SMTP_PASSWORD=${SMTP_PASSWORD}
      - SMTP_FROM=IT Support Cereda <it-tool@cereda-systems.de>
      # IMAP (eingehende E-Mails → Tickets)
      - IMAP_HOST=outlook.office365.com
      - IMAP_PORT=993
      - IMAP_USER=it-tool@cereda-systems.de
      - IMAP_PASSWORD=${IMAP_PASSWORD}
      - IMAP_MAILBOX=INBOX
      # Ticket-Links in E-Mails
      - TICKET_BASE_URL=https://it-nexus.cereda-systems.de
      # Monitoring-Mailbox (NetGo Alerts)
      - MONITORING_MAILBOX=helpdesk@cereda-systems.de
      # Microsoft Azure AD (OAuth2 + Graph API)
      - AZURE_TENANT_ID=6a9a4382-ea6c-4e64-a09f-0905f83b3d64
      - AZURE_CLIENT_ID=de5c4a83-d24d-4323-9f3b-9c3a2f6c709f
      - AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET}
      - AZURE_REDIRECT_URI=https://it-nexus.cereda-systems.de/api/auth/microsoft/callback
      # Anthropic Claude API (KI-Integration)
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      # Teams Bot
      - TEAMS_BOT_APP_ID=bd39de7e-1b85-4e0c-9301-a68cd5122523
      - TEAMS_BOT_APP_SECRET=${TEAMS_BOT_APP_SECRET}
      # Microsoft Planner Sync
      - PLANNER_PLAN_ID=CFyoAifRzUi2ONlk01smWpcAHtm3
      # Proxmox Monitoring
      - PROXMOX_HOST=https://192.168.0.184:8006
      - PROXMOX_TOKEN=${PROXMOX_TOKEN}
      - PROXMOX_NODE=hve-01
      # GitHub API (Feedback-System)
      - GITHUB_TOKEN=${GITHUB_TOKEN}
    volumes:
      # Persistente Datenbank - bleibt auch nach Container-Neustart erhalten
      - fido-data:/app/data
      # Persistente Uploads (PDFs, Bilder) - bleibt auch nach Container-Neustart erhalten
      - fido-uploads:/app/uploads
      # Agent-Downloads (Installer, intunewin)
      - fido-downloads:/app/downloads
      # Agent-Skripte (PS1 + Installer) direkt vom Host eingebunden
      - ./agent:/app/agent:ro
      # Docker Socket für Docker-Management-Seite
      - /var/run/docker.sock:/var/run/docker.sock:ro
    privileged: true
    security_opt:
      - apparmor=unconfined
      - seccomp=unconfined
    networks:
      - it-nexus-network
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:5000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Frontend Service
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    container_name: it-nexus-frontend
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8443:443"
    depends_on:
      - backend
    privileged: true
    security_opt:
      - apparmor=unconfined
      - seccomp=unconfined
    networks:
      - it-nexus-network
    healthcheck:
      test: ["CMD-SHELL", "pgrep -x nginx || nginx -t"]
      interval: 30s
      timeout: 10s
      retries: 3

# Volumes für persistente Daten
volumes:
  fido-data:
    driver: local
  fido-uploads:
    driver: local
  fido-downloads:
    driver: local

# Netzwerk für die Services
networks:
  it-nexus-network:
    driver: bridge