version: '3.8'

services:
  # Backend Service
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: it-nexus-backend
    restart: unless-stopped
    ports:
      - "5000:5000"
    environment:
      - NODE_ENV=production
      - PORT=5000
      - JWT_SECRET=jwt-jItWbLMHTIDElss0C3tMN6NV3hq3GjEIPXp79-X8ljiMS6OMX541Xg
      - AGENT_API_KEY=itx-4CPJPTHmCfdrL9D62WacCATEvuvULXcp7ECMpSaNUjsS344F6_L4Ug
      - SCANNER_API_KEY=nsx-aa0193d719c2be765441e1dd24bf7480
      - JWT_EXPIRATION=8h
      - DATABASE_PATH=/app/data/database.sqlite
      - FRONTEND_URL=https://it-nexus.cereda-systems.de
      - BCRYPT_ROUNDS=12
      # SMTP (ausgehende E-Mails)
      - SMTP_HOST=smtp-mail.outlook.com
      - SMTP_PORT=587
      - SMTP_SECURE=false
      - SMTP_USER=it-tool@cereda-systems.de
      - SMTP_PASSWORD=Cereda2025!
      - SMTP_FROM=IT Support Cereda <it-tool@cereda-systems.de>
      # IMAP (eingehende E-Mails → Tickets)
      - IMAP_HOST=outlook.office365.com
      - IMAP_PORT=993
      - IMAP_USER=it-tool@cereda-systems.de
      - IMAP_PASSWORD=Cereda2025!
      - IMAP_MAILBOX=INBOX
      # Ticket-Links in E-Mails
      - TICKET_BASE_URL=https://it-nexus.cereda-systems.de
      # Monitoring-Mailbox (NetGo Alerts)
      - MONITORING_MAILBOX=helpdesk@cereda-systems.de
      # Microsoft Azure AD (OAuth2 + Graph API)
      - AZURE_TENANT_ID=6a9a4382-ea6c-4e64-a09f-0905f83b3d64
      - AZURE_CLIENT_ID=de5c4a83-d24d-4323-9f3b-9c3a2f6c709f
      - AZURE_CLIENT_SECRET=55f8Q~BAYuFl5-zsX4Aob397PKLZssNTVc9rFb9n
      - AZURE_REDIRECT_URI=https://it-nexus.cereda-systems.de/api/auth/microsoft/callback
      # Anthropic Claude API (KI-Integration)
      - ANTHROPIC_API_KEY=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
      # Teams Bot
      - TEAMS_BOT_APP_ID=bd39de7e-1b85-4e0c-9301-a68cd5122523
      - TEAMS_BOT_APP_SECRET=jos8Q~UjN.Z65.3e9JeXpeKJdX6li58I2EnhfbZQ
      # Microsoft Planner Sync
      - PLANNER_PLAN_ID=CFyoAifRzUi2ONlk01smWpcAHtm3
      # Proxmox Monitoring
      - PROXMOX_HOST=https://192.168.0.184:8006
      - PROXMOX_TOKEN=root@pam!monitoring=ca287965-3d33-49ec-a069-1bb80fd2e95d
      - PROXMOX_NODE=hve-01
      # GitHub API (Feedback-System)
      - GITHUB_TOKEN=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
    volumes:
      # Persistente Datenbank - bleibt auch nach Container-Neustart erhalten
      - fido-data:/app/data
      # Persistente Uploads (PDFs, Bilder) - bleibt auch nach Container-Neustart erhalten
      - fido-uploads:/app/uploads
      # Agent-Downloads (Installer, intunewin)
      - fido-downloads:/app/downloads
      # Agent-Skripte (PS1 + Installer) direkt vom Host eingebunden
      - ./agent:/app/agent:ro
      # Docker Socket für Docker-Management-Seite
      - /var/run/docker.sock:/var/run/docker.sock:ro
    privileged: true
    security_opt:
      - apparmor=unconfined
      - seccomp=unconfined
    networks:
      - it-nexus-network
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:5000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Frontend Service
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    container_name: it-nexus-frontend
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8443:443"
    depends_on:
      - backend
    privileged: true
    security_opt:
      - apparmor=unconfined
      - seccomp=unconfined
    networks:
      - it-nexus-network
    healthcheck:
      test: ["CMD-SHELL", "pgrep -x nginx || nginx -t"]
      interval: 30s
      timeout: 10s
      retries: 3

# Volumes für persistente Daten
volumes:
  fido-data:
    driver: local
  fido-uploads:
    driver: local
  fido-downloads:
    driver: local

# Netzwerk für die Services
networks:
  it-nexus-network:
    driver: bridge
