# ============================================================================
# Zitadel docker-compose.yml.template
# ============================================================================
# Basé sur la quickstart officielle Zitadel avec proxy Traefik intégré.
# Source : https://github.com/zitadel/zitadel-charts/tree/main/charts/zitadel
#
# Ce docker-compose contient :
# - proxy : Traefik dédié à Zitadel
# - zitadel : Serveur API
# - zitadel-login : UI de login v2
# - postgres : DB dédiée
#
# ⚠️ Ce fichier est SIMPLIFIÉ. Pour la version complète production-ready,
#    voir le repo officiel : https://github.com/zitadel/zitadel-charts
# ============================================================================

name: zitadel

services:
  # Traefik dédié à Zitadel (isolé du Traefik principal)
  proxy:
    image: ${TRAEFIK_IMAGE}
    restart: unless-stopped
    command:
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=zitadel
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --api.dashboard=${TRAEFIK_DASHBOARD_ENABLED}
      - --api.insecure=false
      - --ping=true
      - --ping.entrypoint=web
      - --log.level=${TRAEFIK_LOG_LEVEL}
      - --accesslog=${TRAEFIK_ACCESSLOG_ENABLED}
    ports:
      - ${PROXY_HTTP_PUBLISHED_PORT}:80
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - zitadel
      - web  # Pour que le Traefik principal puisse router vers ici
    labels:
      # Permet au Traefik principal externe de router vers ce Traefik interne
      - "traefik.enable=true"
      - "traefik.http.routers.zitadel-external.rule=Host(`${ZITADEL_EXTERNALDOMAIN}`)"
      - "traefik.http.routers.zitadel-external.entrypoints=websecure"
      - "traefik.http.routers.zitadel-external.tls.certresolver=letsencrypt"
      - "traefik.http.services.zitadel-external.loadbalancer.server.port=80"

  zitadel:
    image: ghcr.io/zitadel/zitadel:v4.13.0
    restart: unless-stopped
    command: 'start-from-init --masterkey "${ZITADEL_MASTERKEY}" --tlsMode disabled'
    environment:
      ZITADEL_DATABASE_POSTGRES_HOST: postgres
      ZITADEL_DATABASE_POSTGRES_PORT: 5432
      ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_USERNAME: zitadel
      ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: ${ZITADEL_DATABASE_POSTGRES_USER_PASSWORD}
      ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
      ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
      ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: ${ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD}
      ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
      ZITADEL_EXTERNALDOMAIN: ${ZITADEL_EXTERNALDOMAIN}
      ZITADEL_EXTERNALPORT: 443
      ZITADEL_EXTERNALSECURE: "true"
      ZITADEL_TLS_ENABLED: "false"
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME: ${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME}
      ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD: ${ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD}
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - zitadel
    healthcheck:
      test: ["CMD", "/app/zitadel", "ready", "--config", "/example-zitadel-config.yaml"]
      interval: 10s
      timeout: 30s
      retries: 5
      start_period: 20s
    volumes:
      - ./machinekey:/machinekey
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.zitadel.rule=Host(`${ZITADEL_EXTERNALDOMAIN}`) && (PathPrefix(`/zitadel.`) || PathPrefix(`/oauth/v2`) || PathPrefix(`/openid`) || PathPrefix(`/saml`) || PathPrefix(`/.well-known`))"
      - "traefik.http.routers.zitadel.entrypoints=web"
      - "traefik.http.services.zitadel.loadbalancer.server.port=8080"

  zitadel-login:
    image: ghcr.io/zitadel/zitadel-login:v4.13.0
    restart: unless-stopped
    environment:
      ZITADEL_API_URL: http://zitadel:8080
      ZITADEL_LOGIN_BASE_URL: https://${ZITADEL_EXTERNALDOMAIN}/ui/v2/login
      NEXTAUTH_URL: https://${ZITADEL_EXTERNALDOMAIN}/ui/v2/login
    depends_on:
      zitadel:
        condition: service_healthy
    networks:
      - zitadel
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--spider", "http://localhost:3000"]
      interval: 10s
      timeout: 30s
      retries: 5
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.zitadel-login.rule=Host(`${ZITADEL_EXTERNALDOMAIN}`)"
      - "traefik.http.routers.zitadel-login.entrypoints=web"
      - "traefik.http.routers.zitadel-login.priority=10"
      - "traefik.http.services.zitadel-login.loadbalancer.server.port=3000"

  postgres:
    image: postgres:17.2-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: ${ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD}
      POSTGRES_DB: zitadel
    networks:
      - zitadel
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d zitadel"]
      interval: 10s
      timeout: 30s
      retries: 5
      start_period: 20s
    volumes:
      - ./postgres-data:/var/lib/postgresql/data:rw

networks:
  zitadel:
    driver: bridge
  web:
    external: true