mb-grid-solutions.com/docker-compose.yaml

services:
  app:
    image: registry.infra.mintel.me/mintel/mb-grid-solutions:${IMAGE_TAG:-latest}
    restart: always
    networks:
      - infra
    env_file:
      - ${ENV_FILE:-.env}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${PROJECT_NAME}.rule=${TRAEFIK_RULE:-Host(`${TRAEFIK_HOST:-mb-grid-solutions.localhost}`)}"
      - "traefik.http.routers.${PROJECT_NAME}.entrypoints=websecure"
      - "traefik.http.routers.${PROJECT_NAME}.tls.certresolver=le"
      - "traefik.http.routers.${PROJECT_NAME}.tls=true"
      - "traefik.http.services.${PROJECT_NAME}.loadbalancer.server.port=3000"
      - "traefik.http.routers.${PROJECT_NAME}.middlewares=${TRAEFIK_MIDDLEWARES:-${PROJECT_NAME}-auth,${PROJECT_NAME}-forward,compress}"
      - "traefik.docker.network=infra"

      # Forwarded Headers (Protocol Normalization)
      - "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"

      # Gatekeeper Router (Shared Host + dedicated Subdomain)
      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.rule=${GATEKEEPER_RULE:-(Host(`${TRAEFIK_HOST:-mb-grid-solutions.localhost}`) && PathPrefix(`/gatekeeper`)) || Host(`gatekeeper.${TRAEFIK_HOST:-mb-grid-solutions.localhost}`)}"
      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.entrypoints=websecure"
      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.tls.certresolver=le"
      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.tls=true"
      - "traefik.http.routers.${PROJECT_NAME}-gatekeeper.service=${PROJECT_NAME}-gatekeeper"

      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.address=http://${PROJECT_NAME}-gatekeeper:3000/api/verify"
      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.${PROJECT_NAME}-auth.forwardauth.authResponseHeaders=X-Auth-User"
      - "traefik.docker.network=infra"
    healthcheck:
      test: [ "CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/health').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))" ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  gatekeeper:
    image: registry.infra.mintel.me/mintel/gatekeeper:v1.7.3
    container_name: ${PROJECT_NAME:-mb-grid-solutions}-gatekeeper
    restart: always
    networks:
      infra:
        aliases:
          - ${PROJECT_NAME:-mb-grid-solutions}-gatekeeper
    env_file:
      - ${ENV_FILE:-.env}
    environment:
      PORT: ${PORT:-3000}
      PROJECT_NAME: ${PROJECT_NAME:-MB Grid Solutions}
      PROJECT_COLOR: ${PROJECT_COLOR:-#82ed20}
      COOKIE_DOMAIN: ${COOKIE_DOMAIN:-.mb-grid-solutions.com}
      AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-mintel_gatekeeper_session}
      GATEKEEPER_PASSWORD: ${GATEKEEPER_PASSWORD:-mintel}
      # Dedicated Base URL for Gatekeeper subdomain to prevent redirect loops
      NEXT_PUBLIC_BASE_URL: https://${GATEKEEPER_HOST:-gatekeeper.mb-grid-solutions.localhost}
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.${PROJECT_NAME}-gatekeeper.loadbalancer.server.port=3000"
      - "traefik.docker.network=infra"

  directus:
    image: directus/directus:11
    restart: always
    networks:
      infra:
        aliases:
          - ${PROJECT_NAME:-mb-grid-solutions}-directus
      backend:
    env_file:
      - ${ENV_FILE:-.env}
    environment:
      DB_CLIENT: 'pg'
      DB_HOST: 'directus-db'
      DB_PORT: '5432'
      WEBSOCKETS_ENABLED: 'true'
      PUBLIC_URL: ${DIRECTUS_URL}
      KEY: ${DIRECTUS_KEY}
      SECRET: ${DIRECTUS_SECRET}
      ADMIN_EMAIL: ${DIRECTUS_ADMIN_EMAIL}
      ADMIN_PASSWORD: ${DIRECTUS_ADMIN_PASSWORD}
      DB_DATABASE: ${DIRECTUS_DB_NAME:-directus}
      DB_USER: ${DIRECTUS_DB_USER:-directus}
      DB_PASSWORD: ${DIRECTUS_DB_PASSWORD:-directus}
      # Telemetry & Performance
      LOGGER_LEVEL: ${LOG_LEVEL:-info}
      SENTRY_DSN: ${SENTRY_DSN}
      SENTRY_ENVIRONMENT: ${TARGET:-development}
    volumes:
      - ./directus/uploads:/directus/uploads
      - ./directus/extensions:/directus/extensions
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.${PROJECT_NAME}-directus.rule=Host(`${DIRECTUS_HOST:-cms.mb-grid-solutions.localhost}`)"
      - "traefik.http.routers.${PROJECT_NAME}-directus.entrypoints=websecure"
      - "traefik.http.routers.${PROJECT_NAME}-directus.tls.certresolver=le"
      - "traefik.http.routers.${PROJECT_NAME}-directus.tls=true"
      - "traefik.http.routers.${PROJECT_NAME}-directus.middlewares=${PROJECT_NAME}-forward,compress"
      - "traefik.http.services.${PROJECT_NAME}-directus.loadbalancer.server.port=8055"
      - "traefik.http.middlewares.${PROJECT_NAME}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.docker.network=infra"

  directus-db:
    image: postgres:15-alpine
    restart: always
    networks:
      - backend
    env_file:
      - ${ENV_FILE:-.env}
    environment:
      POSTGRES_DB: ${DIRECTUS_DB_NAME:-directus}
      POSTGRES_USER: ${DIRECTUS_DB_USER:-directus}
      POSTGRES_PASSWORD: ${DIRECTUS_DB_PASSWORD:-directus}
    volumes:
      - directus-db-data:/var/lib/postgresql/data

networks:
  infra:
    external: true
  backend:
    internal: true

volumes:
  directus-db-data: