docker-compose.yml

services:
  db:
    image: postgres:16-alpine
    container_name: ausleihbar_db
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-ausleihbar}
      POSTGRES_USER: ${POSTGRES_USER:-ausleihbar}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ausleihbar}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-ausleihbar} -d ${POSTGRES_DB:-ausleihbar}"]
      interval: 5s
      timeout: 5s
      retries: 5

  backend:
    build:
      context: ./backend
    container_name: ausleihbar_backend
    restart: unless-stopped
    command: sh -c "python manage.py compilemessages && python manage.py runserver 0.0.0.0:8000"
    volumes:
      - ./backend:/app
    ports:
      # Host port (default 8000). Override BACKEND_PORT in .env if 8000 is taken.
      - "${BACKEND_PORT:-8000}:8000"
    environment:
      DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY:-dev-insecure-secret-key-change-me}
      DJANGO_DEBUG: ${DJANGO_DEBUG:-1}
      POSTGRES_DB: ${POSTGRES_DB:-ausleihbar}
      POSTGRES_USER: ${POSTGRES_USER:-ausleihbar}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-ausleihbar}
      POSTGRES_HOST: db
      POSTGRES_PORT: 5432
      # OIDC (local Keycloak). The browser uses localhost:8080 for the login
      # redirect; the backend reaches Keycloak via host.docker.internal:8080.
      OIDC_RP_CLIENT_ID: ${OIDC_RP_CLIENT_ID:-ausleihbar-backend}
      OIDC_RP_CLIENT_SECRET: ${OIDC_RP_CLIENT_SECRET:-ausleihbar-dev-secret}
      OIDC_OP_AUTHORIZATION_ENDPOINT: ${OIDC_OP_AUTHORIZATION_ENDPOINT:-http://localhost:8080/realms/ausleihbar/protocol/openid-connect/auth}
      OIDC_OP_TOKEN_ENDPOINT: ${OIDC_OP_TOKEN_ENDPOINT:-http://host.docker.internal:8080/realms/ausleihbar/protocol/openid-connect/token}
      OIDC_OP_USER_ENDPOINT: ${OIDC_OP_USER_ENDPOINT:-http://host.docker.internal:8080/realms/ausleihbar/protocol/openid-connect/userinfo}
      OIDC_OP_JWKS_ENDPOINT: ${OIDC_OP_JWKS_ENDPOINT:-http://host.docker.internal:8080/realms/ausleihbar/protocol/openid-connect/certs}
      OIDC_OP_LOGOUT_ENDPOINT: ${OIDC_OP_LOGOUT_ENDPOINT:-http://localhost:8080/realms/ausleihbar/protocol/openid-connect/logout}
      # Members of this IdP group are granted Django admin on login.
      OIDC_ADMIN_GROUP: ${OIDC_ADMIN_GROUP:-ausleihbar-admins}
      # Per-provider claim mapping (defaults match standard OIDC); forwarded so
      # overriding them in .env actually takes effect.
      OIDC_CLAIM_USERNAME: ${OIDC_CLAIM_USERNAME:-preferred_username}
      OIDC_CLAIM_EMAIL: ${OIDC_CLAIM_EMAIL:-email}
      OIDC_CLAIM_FIRST_NAME: ${OIDC_CLAIM_FIRST_NAME:-given_name}
      OIDC_CLAIM_LAST_NAME: ${OIDC_CLAIM_LAST_NAME:-family_name}
      # Email notifications. Dev defaults to the console backend (mails are
      # printed to this log). For real delivery set these in .env, e.g.
      # EMAIL_BACKEND=django.core.mail.backends.smtp.EmailBackend + EMAIL_HOST/…
      EMAIL_BACKEND: ${EMAIL_BACKEND:-django.core.mail.backends.console.EmailBackend}
      EMAIL_HOST: ${EMAIL_HOST:-localhost}
      EMAIL_PORT: ${EMAIL_PORT:-25}
      EMAIL_HOST_USER: ${EMAIL_HOST_USER:-}
      EMAIL_HOST_PASSWORD: ${EMAIL_HOST_PASSWORD:-}
      EMAIL_USE_TLS: ${EMAIL_USE_TLS:-0}
      DEFAULT_FROM_EMAIL: ${DEFAULT_FROM_EMAIL:-Ausleihbar <noreply@ausleihbar.local>}
      SHOP_BASE_URL: ${SHOP_BASE_URL:-http://localhost:5173}
      # Canonical content language (issue #6): the language required when
      # editing catalog content and the first shop fallback. "de" or "en".
      CONTENT_DEFAULT_LANGUAGE: ${CONTENT_DEFAULT_LANGUAGE:-de}
      # Optional machine-translation pre-fill (issue #6 Phase 4). Off by default;
      # set CONTENT_TRANSLATION_PROVIDER=libretranslate and start the optional
      # libretranslate service (`docker compose --profile translation up -d`).
      CONTENT_TRANSLATION_PROVIDER: ${CONTENT_TRANSLATION_PROVIDER:-none}
      LIBRETRANSLATE_URL: ${LIBRETRANSLATE_URL:-http://libretranslate:5000}
      LIBRETRANSLATE_API_KEY: ${LIBRETRANSLATE_API_KEY:-}
      # Encrypts stored secrets at rest (per-pool GitLab token). Optional in dev;
      # falls back to a key derived from DJANGO_SECRET_KEY when unset.
      TOKEN_ENCRYPTION_KEY: ${TOKEN_ENCRYPTION_KEY:-}
      # Optional creation caps; blank = unlimited.
      MAX_RESOURCES: ${MAX_RESOURCES:-}
      MAX_PRODUCTS: ${MAX_PRODUCTS:-}
      MAX_USERS: ${MAX_USERS:-}
      # Optional AI features (LiteLLM, OpenAI-compatible). Off unless AI_PROVIDER=litellm.
      AI_PROVIDER: ${AI_PROVIDER:-none}
      AI_BASE_URL: ${AI_BASE_URL:-}
      AI_API_KEY: ${AI_API_KEY:-}
      AI_MODEL: ${AI_MODEL:-}
      AI_TIMEOUT: ${AI_TIMEOUT:-30}
      AI_MAX_TOKENS: ${AI_MAX_TOKENS:-2000}
      AI_DISABLE_THINKING: ${AI_DISABLE_THINKING:-1}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    depends_on:
      db:
        condition: service_healthy
      keycloak:
        condition: service_started

  keycloak:
    image: quay.io/keycloak/keycloak:26.0.7
    container_name: ausleihbar_keycloak
    restart: unless-stopped
    command: ["start-dev", "--import-realm"]
    environment:
      KC_BOOTSTRAP_ADMIN_USERNAME: ${KEYCLOAK_ADMIN:-admin}
      KC_BOOTSTRAP_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
      KC_HOSTNAME: http://localhost:8080
      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
      KC_HTTP_ENABLED: "true"
    ports:
      - "8080:8080"
    volumes:
      - ./keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:ro

  frontend:
    build:
      context: ./frontend
    container_name: ausleihbar_frontend
    restart: unless-stopped
    command: npm run dev -- --host 0.0.0.0 --port 5173
    volumes:
      - ./frontend:/app
      - /app/node_modules
    ports:
      - "5173:5173"
    environment:
      VITE_API_BASE_URL: ${VITE_API_BASE_URL:-http://localhost:8000}
    depends_on:
      - backend

  # Optional self-hosted machine translation (issue #6 Phase 4). Only starts
  # with `docker compose --profile translation up -d`; also set
  # CONTENT_TRANSLATION_PROVIDER=libretranslate in .env to enable the editor's
  # pre-fill. First start downloads the de/en language model.
  libretranslate:
    image: libretranslate/libretranslate:latest
    container_name: ausleihbar_libretranslate
    restart: unless-stopped
    profiles: ["translation"]
    environment:
      LT_LOAD_ONLY: ${LIBRETRANSLATE_LOAD_ONLY:-en,de}
    ports:
      - "${LIBRETRANSLATE_PORT:-5000}:5000"
    volumes:
      - libretranslate_models:/home/libretranslate/.local

volumes:
  postgres_data:
  libretranslate_models: