name: ${COMPOSE_PROJECT_NAME:-roundcube}

# Roundcube Webmail : nginx (frontal) -> php-fpm (Roundcube) -> MariaDB
# Variables : voir .env.example

services:
  mariadb:
    image: mariadb:${MARIADB_VERSION:-11.8}
    restart: unless-stopped
    command:
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
    environment:
      MARIADB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:?DB_ROOT_PASSWORD manquant dans .env}
      MARIADB_DATABASE: ${DB_NAME:-roundcubemail}
      MARIADB_USER: ${DB_USER:-roundcube}
      MARIADB_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD manquant dans .env}
      MARIADB_AUTO_UPGRADE: "1"
    volumes:
      - db:/var/lib/mysql
    networks: [backend]
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 30s

  roundcube:
    build:
      context: .
      dockerfile: roundcube/Dockerfile
      args:
        RC_VERSION: ${RC_VERSION:-1.7.4}
        ASPELL_DICTS: ${ASPELL_DICTS:-fr en}
    image: ${RC_IMAGE:-local/roundcube}:${RC_VERSION:-1.7.4}
    restart: unless-stopped
    depends_on:
      mariadb:
        condition: service_healthy
    environment:
      ROUNDCUBEMAIL_DB_TYPE: mysql
      ROUNDCUBEMAIL_DB_HOST: mariadb
      ROUNDCUBEMAIL_DB_PORT: 3306
      ROUNDCUBEMAIL_DB_NAME: ${DB_NAME:-roundcubemail}
      ROUNDCUBEMAIL_DB_USER: ${DB_USER:-roundcube}
      ROUNDCUBEMAIL_DB_PASSWORD: ${DB_PASSWORD}
      ROUNDCUBEMAIL_DES_KEY: ${RC_DES_KEY:?RC_DES_KEY manquant dans .env (24 caractères)}
      ROUNDCUBEMAIL_DEFAULT_HOST: ${IMAP_HOST:?IMAP_HOST manquant dans .env}
      ROUNDCUBEMAIL_DEFAULT_PORT: ${IMAP_PORT:-993}
      ROUNDCUBEMAIL_SMTP_SERVER: ${SMTP_HOST:?SMTP_HOST manquant dans .env}
      ROUNDCUBEMAIL_SMTP_PORT: ${SMTP_PORT:-587}
      ROUNDCUBEMAIL_USERNAME_DOMAIN: ${USERNAME_DOMAIN:-}
      ROUNDCUBEMAIL_PLUGINS: ${RC_PLUGINS:-archive,zipdownload,managesieve,markasjunk}
      ROUNDCUBEMAIL_COMPOSER_PLUGINS: ${RC_COMPOSER_PLUGINS:-}
      ROUNDCUBEMAIL_SKIN: elastic
      ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: ${UPLOAD_MAX_FILESIZE:-25M}
      TZ: ${TZ:-Europe/Paris}
    volumes:
      - www:/var/www/html                       # sources Roundcube (partagées avec nginx)
      - ./config:/var/roundcube/config:ro       # surcharges PHP (*.php inclus dans l'ordre alpha)
      - temp:/tmp/roundcube-temp
      - enigma:/var/roundcube/enigma            # clés OpenPGP si plugin enigma
    networks: [backend, frontend]               # frontend = sortie vers IMAP/SMTP
    healthcheck:
      test: ["CMD", "php", "-r", "exit(@fsockopen('127.0.0.1', 9000) ? 0 : 1);"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 120s                        # 1er démarrage : copie des sources + initdb

  nginx:
    image: nginx:${NGINX_VERSION:-1.30-alpine}
    restart: unless-stopped
    depends_on:
      roundcube:
        condition: service_healthy
    environment:
      NGINX_PHP_FPM: roundcube:9000
      NGINX_CLIENT_MAX_BODY_SIZE: ${UPLOAD_MAX_FILESIZE:-25M}
      NGINX_ENVSUBST_FILTER: ^NGINX_          # n'interpole que nos variables
      TZ: ${TZ:-Europe/Paris}
    volumes:
      - www:/var/www/html:ro
      - ./nginx/templates:/etc/nginx/templates:ro
    ports:
      - "${HTTP_BIND:-127.0.0.1}:${HTTP_PORT:-8080}:80"
    networks: [frontend]
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://127.0.0.1/fpm-ping | grep -q pong"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 10s

volumes:
  db:
  www:
  temp:
  enigma:

networks:
  backend:
    internal: true          # MariaDB sans accès sortant ni exposition
  frontend: