# afaq — local development stack.
#
#   app          PHP 7.4 + Apache, afaq bind-mounted at /var/www/html
#   sftp         chrooted SFTP drop point + HTTP file server (afaq's FTP driver)
#   filebrowser  web UI to browse/upload files in the SFTP root (no login)
#
# The MySQL database is NOT run here. afaq connects to MySQL already installed on
# this PC (reach it via host.docker.internal) or on the local network (reach it
# by its 192.168.x.x IP — the default bridge network NATs out to the LAN). Set
# MASTER_HOST / SLAVE_*_HOST in .env accordingly (see .env.docker.example).
#
# On every `up`, the app entrypoint writes the SFTP credentials below into the
# project .env (SFTP_HOST/SFTP_USER/SFTP_PASSWORD + FILE_SYSTEM_DRIVER).
#
# Ports are offset so this stack can run alongside maqsurah_main's.

services:
  app:
    build:
      context: ./docker/app
    image: afaq-app:dev
    container_name: afaq-app
    restart: unless-stopped
    ports:
      - "8090:80"     # http://localhost:8090
      - "8453:443"    # https://localhost:8453 (self-signed)
    volumes:
      - ./:/var/www/html                                    # bind-mount the project (NOT copied)
      - ./docker/app/php.ini:/usr/local/etc/php/php.ini:ro  # tune PHP without a rebuild
    environment:
      # Mirrored into .env on boot so afaq's FTP driver targets the sftp service.
      FILE_SYSTEM_DRIVER: "FTP"
      SFTP_HOST: "sftp"
      SFTP_USER: "afaq_ftp_user"
      SFTP_PASS: "afaq_ftp_pwd"
    extra_hosts:
      - "host.docker.internal:host-gateway"   # reach the host PC's MySQL
    depends_on:
      - sftp

  sftp:
    build:
      context: ./docker/sftp
    image: afaq-sftp:dev
    container_name: afaq-sftp
    restart: unless-stopped
    ports:
      - "2223:22"     # SFTP for host-side clients. The app reaches it as host "sftp".
      - "8084:80"     # uploaded files over HTTP  -> http://localhost:8084/<file>
      - "9453:443"    # uploaded files over HTTPS -> https://localhost:9453/<file>
    environment:
      SFTP_USER: "afaq_ftp_user"
      SFTP_PASS: "afaq_ftp_pwd"
    volumes:
      - sftp_data:/srv/sftp/data   # named volume: keeps chroot ownership correct & persists uploads

  filebrowser:
    image: filebrowser/filebrowser:latest
    container_name: afaq-files
    restart: unless-stopped
    # Runs as root so it can write into the SFTP uploads dir (owned by the SFTP
    # user). First start initializes its DB: no-login (auth.method=noauth) and
    # file/dir modes 644/755 so web-uploaded files stay readable by the sftp
    # Apache. An admin user is created only because noauth needs one to exist.
    user: "0:0"
    ports:
      - "8086:80"     # http://localhost:8086  (opens straight into the file browser)
    volumes:
      - sftp_data:/srv          # the SFTP root, shared with the sftp service
      - fb_database:/database   # filebrowser's own settings DB
    entrypoint:
      - sh
      - -c
      - |
        if [ ! -f /database/filebrowser.db ]; then
          filebrowser -d /database/filebrowser.db config init --minimumPasswordLength 6 --fileMode 0o644 --dirMode 0o755
          filebrowser -d /database/filebrowser.db users add admin afaq123456 --perm.admin
          filebrowser -d /database/filebrowser.db config set --auth.method=noauth
        fi
        exec filebrowser -d /database/filebrowser.db -r /srv -a 0.0.0.0 -p 80
    depends_on:
      - sftp

volumes:
  sftp_data:
  fb_database:
