services:
  # --- 1. OIDC SECURITY PROXY ---
  auth_proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:latest
    container_name: ${STACK_NAME:-opencode_20}_oidc_proxy
    restart: always
    ports:
      - "${HOST_PORT:-4180}:4180"
    environment:
      - OAUTH2_PROXY_HTTP_ADDRESS=0.0.0.0:4180
      - OAUTH2_PROXY_REDIRECT_URL=https://${DOMAIN_NAME:-localhost}/oauth2/callback
      - OAUTH2_PROXY_EMAIL_DOMAINS=*
      - OAUTH2_PROXY_UPSTREAM=http://app:4096
      - OAUTH2_PROXY_PROVIDER=${OIDC_PROVIDER:-generic}
      - OAUTH2_PROXY_CLIENT_ID=${OIDC_CLIENT_ID:-fallback_id}
      - OAUTH2_PROXY_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-fallback_secret}
      - OAUTH2_PROXY_OIDC_ISSUER_URL=${OIDC_ISSUER_URL:-https://localhost/issuer}
      - OAUTH2_PROXY_COOKIE_SECRET=${OIDC_COOKIE_SECRET:-Vk5mbU16UnpOSGRDTVZ4T1ZsTmJZazlTZkU5VzBRMD0=}
      - OAUTH2_PROXY_COOKIE_SECURE=${COOKIE_SECURE_HTTPS:-false}
    networks:
      - proxy_network
      - backend_network

  # --- 2. MULTI-PROJECT OPENCODE SERVER ---
  app:
    image: ghcr.io/anomalyco/opencode:${APP_IMAGE_TAG:-2.0.0}
    container_name: ${STACK_NAME:-opencode_20}_server
    restart: always
    # Wir starten den Server im übergeordneten /workspaces Ordner
    command: opencode serve --port 4096 --hostname 0.0.0.0
    environment:
      # Globale Git Identität für alle Commits des Agenten
      - GIT_USER_NAME=${GIT_USER_NAME:-OpenCode Agent}
      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-opencode-bot@local.internal}
      
      # Das Token wird als Umgebungsvariable bereitgestellt, damit Git-Befehle im Chat autorisiert sind
      - GITEA_TOKEN=${GITEA_PAT:?error_GITEA_PAT_is_required}
      - GITHUB_TOKEN=${GITEA_PAT:-}
      
      # KI & DB
      - OPENAI_API_KEY=${OPENAI_KEY:-}
      - ANTHROPIC_API_KEY=${ANTHROPIC_KEY:-}
      - DB_HOST=db
      - DB_USER=${DB_USER:-opencode_user}
      - DB_PASSWORD=${DB_PASSWORD:-test_password_123_secure}
      - DB_NAME=${DB_NAME:-opencode_db}
    volumes:
      # Ein globaler Ordner auf Ihrem Server, der alle Ihre Git-Projekte enthält
      - ${HOST_WORKSPACES_ROOT_PATH:-workspaces_data}:/workspaces
      # MCP-Konfiguration und Einstellungen
      - ${HOST_CONFIG_PATH:-app_config}:/root/.config/opencode
    # Der Server startet im Root-Verzeichnis aller Projekte
    working_dir: /workspaces
    networks:
      - backend_network
    depends_on:
      db:
        condition: service_healthy

  # --- 3. DATABASE TIER ---
  db:
    image: postgres:16-alpine
    container_name: ${STACK_NAME:-opencode_20}_db
    restart: always
    environment:
      POSTGRES_USER: ${DB_USER:-opencode_user}
      POSTGRES_PASSWORD: ${DB_PASSWORD:-test_password_123_secure}
      POSTGRES_DB: ${DB_NAME:-opencode_db}
    volumes:
      - ${HOST_DB_VOLUME_PATH:-db_data}:/var/lib/postgresql/data
    networks:
      - backend_network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-opencode_user} -d ${DB_NAME:-opencode_db}"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  db_data:
  workspaces_data:
  app_config:

networks:
  proxy_network:
    driver: bridge
  backend_network:
    driver: bridge
    internal: true