# SyncGames SSOT — MinIO
#
# Console login rule: the URL in the browser address bar and MINIO_*_URL
# must both be reachable FROM YOUR PC'S BROWSER (not only from Docker).
#
#   cp .env.example .env   # set passwords + NAS_LAN_IP
#   docker compose up -d
#   docker compose --profile init run --rm createbuckets

services:
  minio:
    image: quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z
    container_name: syncgames-minio
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      # Must be URLs your BROWSER can open (NAS LAN IP or hostname).
      # Do NOT set these to the Cloudflare public HTTPS hostname for Console use.
      MINIO_SERVER_URL: ${MINIO_SERVER_URL}
      MINIO_BROWSER_REDIRECT_URL: ${MINIO_BROWSER_REDIRECT_URL}
    volumes:
      - minio_data:/data
    ports:
      # 0.0.0.0 so PCs on LAN can reach API+Console (needed for WebUI login)
      - "9000:9000"
      - "9001:9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:9000/minio/health/live"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 20s
    networks:
      - syncgames

  createbuckets:
    image: quay.io/minio/mc:RELEASE.2025-04-16T18-13-26Z
    container_name: syncgames-mc-init
    profiles: ["init"]
    depends_on:
      - minio
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      SYNCGAMES_BUCKET: ${SYNCGAMES_BUCKET:-syncgames}
      APP_ACCESS_KEY: ${APP_ACCESS_KEY}
      APP_SECRET_KEY: ${APP_SECRET_KEY}
    entrypoint:
      - /bin/sh
      - -c
      - |
        set -e
        echo "Waiting for MinIO..."
        i=0
        until mc alias set local http://minio:9000 "$$MINIO_ROOT_USER" "$$MINIO_ROOT_PASSWORD" 2>/dev/null; do
          i=$$((i+1))
          if [ "$$i" -gt 30 ]; then echo "MinIO not ready"; exit 1; fi
          sleep 2
        done
        mc mb --ignore-existing "local/$${SYNCGAMES_BUCKET}"
        mc anonymous set none "local/$${SYNCGAMES_BUCKET}"
        # App user for agents — fail loudly if key cannot be created
        if ! mc admin user info local "$$APP_ACCESS_KEY" >/dev/null 2>&1; then
          mc admin user add local "$$APP_ACCESS_KEY" "$$APP_SECRET_KEY"
        else
          mc admin user add local "$$APP_ACCESS_KEY" "$$APP_SECRET_KEY" 2>/dev/null || true
          # update secret if user exists (MinIO: remove+readd or policy only)
          echo "User $$APP_ACCESS_KEY already exists"
        fi
        mc admin policy attach local readwrite --user "$$APP_ACCESS_KEY"
        mc admin user info local "$$APP_ACCESS_KEY"
        echo "Bucket $${SYNCGAMES_BUCKET} ready"
        mc ls local

  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: syncgames-cloudflared
    profiles: ["tunnel"]
    restart: unless-stopped
    command: tunnel --no-autoupdate run
    environment:
      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN}
    network_mode: host

networks:
  syncgames:
    name: syncgames

volumes:
  minio_data:
    name: syncgames_minio_data