# Interface web (phases 1-2) :
#   docker compose up -d confsync-web          # http://<hôte>:8080 ; mot de passe admin dans les logs au 1er démarrage
# CLI de la phase 0, lancée à la demande avec confsync.yaml :
#   docker compose run --rm confsync check
#   docker compose run --rm confsync diff
#   docker compose run --rm confsync export -o /data/ref.yaml
#   docker compose run --rm confsync apply              # dry-run
#   docker compose run --rm confsync apply -confirm     # application (confirmation SDN interactive)
services:
  confsync-web:
    build: .
    image: pve-confsync:dev
    container_name: pve-confsync-web
    command: ["serve"]
    restart: unless-stopped
    ports:
      - "8080:8080"                                 # ou derrière Traefik (HTTPS : cookies Secure)
    environment:
      TZ: ${TZ:-Europe/Paris}
      CONFSYNC_SECRET_KEY_FILE: /run/secrets/confsync_key   # clé des secrets en base, hors volume /data
      # CONFSYNC_ADMIN_PASSWORD_FILE: /run/secrets/confsync_admin
      # CONFSYNC_IMPORT: /config/confsync.yaml       # import initial de la config CLI (base vide)
      # OIDC_ISSUER: https://auth.example.org/application/o/confsync/
      # OIDC_CLIENT_ID: confsync
      # OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client
      # OIDC_REDIRECT_URL: https://confsync.example.org/auth/callback
      # OIDC_ADMIN_GROUP: confsync-admins
      # OIDC_OPERATOR_GROUP: confsync-operators
    env_file:
      - path: .env
        required: false
    volumes:
      - confsync-data:/data                          # SQLite, session.key
    secrets:
      - confsync_key

  confsync:
    image: pve-confsync:dev
    container_name: pve-confsync
    profiles: ["cli"]                                # pas démarré par "up" ; "run" l'active
    command: ["check"]
    environment:
      TZ: ${TZ:-Europe/Paris}
      PVE_SITE_B_SECRET: ${PVE_SITE_B_SECRET:-}      # secrets par variable (voir token_secret_env)
    env_file:
      - path: .env
        required: false
    volumes:
      - ./confsync.yaml:/config/confsync.yaml:ro
      - confsync-cli:/data                           # exports YAML
    secrets:
      - pve_ref
      - pve_site_a
    stdin_open: true
    tty: true

# Fichiers chmod 600, propriétaire 10001, montés dans /run/secrets/<nom>.
# confsync_key : openssl rand -hex 32 > secrets/confsync_key
secrets:
  confsync_key:
    file: ./secrets/confsync_key
  pve_ref:
    file: ./secrets/pve_ref
  pve_site_a:
    file: ./secrets/pve_site_a

volumes:
  confsync-data:
  confsync-cli: