# Stack tout-en-un : PostgreSQL + Keycloak (realm pré-importé) + l'app MKV→AVI.
#
#   docker compose -f docker-compose.keycloak.yml up -d --build
#
# ⚠️  Ajouter d'abord cette ligne à /etc/hosts (pour que le navigateur ET le
#     conteneur voient Keycloak sous le même nom) :
#         127.0.0.1  keycloak.local
#
# Accès :  app  -> http://localhost:8090   (login: alex / alex)
#          admin Keycloak -> http://localhost:8080  (admin / admin)

name: mkv2avi-stack

services:
  db:
    image: postgres:16-alpine
    container_name: mkv2avi-db
    environment:
      POSTGRES_DB: keycloak
      POSTGRES_USER: keycloak
      POSTGRES_PASSWORD: ${KC_DB_PASSWORD:-keycloak}
    volumes:
      - kc-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U keycloak -d keycloak"]
      interval: 5s
      timeout: 5s
      retries: 12
    restart: unless-stopped

  keycloak:
    image: quay.io/keycloak/keycloak:26.0
    container_name: mkv2avi-keycloak
    command: ["start-dev", "--import-realm"]
    environment:
      KC_DB: postgres
      KC_DB_URL: jdbc:postgresql://db:5432/keycloak
      KC_DB_USERNAME: keycloak
      KC_DB_PASSWORD: ${KC_DB_PASSWORD:-keycloak}
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_ADMIN:-admin}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_ADMIN_PASSWORD:-admin}
      # URL fixe : identique côté navigateur (via /etc/hosts) et côté app (via alias réseau)
      KC_HOSTNAME: http://keycloak.local:8080
      KC_HTTP_ENABLED: "true"
      KC_HEALTH_ENABLED: "true"
    volumes:
      - ./keycloak/realm-mkv2avi.json:/opt/keycloak/data/import/realm-mkv2avi.json:ro
    ports:
      - "8080:8080"
    networks:
      default:
        aliases:
          - keycloak.local
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && cat <&3 | grep -q '200 OK'"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 40s
    restart: unless-stopped

  mkv2avi:
    build: .
    image: mkv2avi:latest
    container_name: mkv2avi
    ports:
      - "8090:8000"
    volumes:
      - ${MEDIA_DIR:-./media}:/media:ro
      - ${OUTPUT_DIR:-./output}:/output
    environment:
      - MAX_WORKERS=1
      - OIDC_ISSUER=http://keycloak.local:8080/realms/mkv2avi
      - OIDC_CLIENT_ID=mkv2avi
      - OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET:-mkv2avi-secret-change-me}
      - SESSION_SECRET=${SESSION_SECRET:-dev-insecure-change-me}
      - SESSION_HTTPS_ONLY=false
    depends_on:
      keycloak:
        condition: service_healthy
    restart: unless-stopped

volumes:
  kc-db: