services:
  # PostgreSQL Database
  db:
    image: postgres:15-alpine
    env_file:
      - .env.production
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - app-network
    # NO exponer puertos al host - solo accesible internamente
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U mac_user -d mac_attendance"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Backend Django
  backend:
    build:
      context: .
      dockerfile: docker/Dockerfile.backend
    command: >
      sh -c "python manage.py migrate &&
             python init_db.py &&
             python manage.py collectstatic --noinput &&
             gunicorn --bind 0.0.0.0:8000 --workers 3 --timeout 300 mac_attendance.wsgi:application"
    volumes:
      - ./backend:/app
      - static_volume:/app/staticfiles
      - media_volume:/app/media
    env_file:
      - .env.production
    networks:
      - app-network
    depends_on:
      db:
        condition: service_healthy
    expose:
      - "8000"

  # Frontend React + Nginx
  nginx:
    build:
      context: .
      dockerfile: docker/Dockerfile.frontend
    ports:
      - "443:443"  # HTTPS (SSL/TLS) - ÚNICO puerto expuesto al host
    volumes:
      - ./docker/nginx.conf:/etc/nginx/conf.d/default.conf
      - ./docker/ssl:/etc/nginx/ssl:ro  # Certificados SSL (solo lectura)
      - static_volume:/app/staticfiles
      - media_volume:/app/media
    depends_on:
      - backend
    networks:
      - app-network

networks:
  app-network:
    # Red interna para comunicación entre contenedores
    # Solo nginx expone puerto 443 al host

volumes:
  static_volume:
  media_volume:
  postgres_data: