name: miccheck-qa

# Dedicated, network-isolated QA stack. Not connected to the dev compose
# stack's network - runs entirely on its own bridge network below. The API has
# no published host port; Postgres is bound to DB_BIND_HOST (docker's bridge
# gateway IP, computed by deploy-qa.sh) so the smoke-qa CI job - itself a
# sibling container on that same default bridge - can seed/inspect data
# directly, while it stays unreachable off-box (unlike binding to 0.0.0.0).
services:

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_DB: miccheck
      POSTGRES_USER: miccheck
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
    ports:
      - "${DB_BIND_HOST:-127.0.0.1}:55432:5432"
    volumes:
      - miccheck-qa-pgdata:/var/lib/postgresql/data
    networks:
      - qa
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U miccheck -d miccheck"]
      interval: 5s
      timeout: 5s
      retries: 10

  api:
    image: ${API_IMAGE}:qa
    environment:
      ASPNETCORE_ENVIRONMENT: Development
      ASPNETCORE_URLS: http://+:8080
      ConnectionStrings__miccheck: "Host=db;Database=miccheck;Username=miccheck;Password=${POSTGRES_PASSWORD}"
      Jwt__SecretKey: ${JWT_SECRET_KEY}
      Jwt__Issuer: MicCheck
      Jwt__Audience: MicCheck
    networks:
      - qa
    depends_on:
      db:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  admin:
    image: ${ADMIN_IMAGE}:qa
    ports:
      - "${QA_ADMIN_PORT:-3001}:80"
    networks:
      - qa
    depends_on:
      api:
        condition: service_started

networks:
  qa:
    name: miccheck-qa-net

volumes:
  miccheck-qa-pgdata:
    name: miccheck-qa-pgdata