docker-compose.yaml

x-medusa-app-db-env: &medusa-app-db-env
  MEDUSA_APP_DB_USER: ${DC_MEDUSA_APP_DB_USER:-medusa_app}
  MEDUSA_APP_DB_PASSWORD: ${DC_MEDUSA_APP_DB_PASSWORD:-medusa_app_change_me}
  MEDUSA_APP_DB_NAME: ${DC_MEDUSA_APP_DB_NAME:-medusa}
  MEDUSA_APP_DB_SCHEMA: ${DC_MEDUSA_APP_DB_SCHEMA:-medusa}

x-medusa-bootstrap-db-env: &medusa-bootstrap-db-env
  <<: *medusa-app-db-env
  MEDUSA_DEV_DB_USER: ${DC_MEDUSA_DEV_DB_USER:-medusa_dev}
  MEDUSA_DEV_DB_PASSWORD: ${DC_MEDUSA_DEV_DB_PASSWORD:-medusa_dev_change_me}
  PAYLOAD_DB_USER: ${DC_PAYLOAD_DATABASE_USER:-payload}
  PAYLOAD_DB_PASSWORD: ${DC_PAYLOAD_DATABASE_PASSWORD:-payload}
  PAYLOAD_DB_NAME: ${DC_MEDUSA_APP_DB_NAME:-medusa}
  PAYLOAD_DB_SCHEMA: ${DC_PAYLOAD_DATABASE_SCHEMA_NAME:-payload}
  MEDUSA_DB_ZANE_OPERATOR_USER: ${DC_ZANE_OPERATOR_PGUSER:-zane_operator}
  MEDUSA_DB_ZANE_OPERATOR_PASSWORD: ${DC_ZANE_OPERATOR_PGPASSWORD:-}
  MEDUSA_DB_ZANE_OPERATOR_DB_TEMPLATE_NAME: ${DC_ZANE_OPERATOR_DB_TEMPLATE_NAME:-template_medusa}

x-medusa-env: &medusa-env
  # Medusa BE: core runtime
  NODE_ENV: ${DC_NODE_ENV:-development}
  JWT_SECRET: ${DC_JWT_SECRET:-supersecret}
  COOKIE_SECRET: ${DC_COOKIE_SECRET:-supersecret}
  MEDUSA_BACKEND_URL: ${DC_MEDUSA_BACKEND_URL:-}
  MEDUSA_COOKIE_SECURE: ${DC_MEDUSA_COOKIE_SECURE:-}
  MEDUSA_COOKIE_SAME_SITE: ${DC_MEDUSA_COOKIE_SAME_SITE:-}
  MEDUSA_ADMIN_DISABLED_FOR_BACKEND_BUILD: ${DC_MEDUSA_ADMIN_DISABLED_FOR_BACKEND_BUILD:-0}
  PRODUCT_REVIEW_TOKEN_EXPIRY_DAYS: ${DC_PRODUCT_REVIEW_TOKEN_EXPIRY_DAYS:-90}
  WORKFLOW_QUEUE_RUNNER_BATCH_SIZE: ${DC_WORKFLOW_QUEUE_RUNNER_BATCH_SIZE:-500}
  WORKFLOW_QUEUE_RUNNER_SCHEDULE: ${DC_WORKFLOW_QUEUE_RUNNER_SCHEDULE:-0 * * * *}
  STORE_CORS: ${DC_STORE_CORS}
  ADMIN_CORS: ${DC_ADMIN_CORS}
  AUTH_CORS: ${DC_AUTH_CORS}
  SUPERADMIN_EMAIL: ${DC_SUPERADMIN_EMAIL:-}
  SUPERADMIN_PASSWORD: ${DC_SUPERADMIN_PASSWORD:-}
  INITIAL_PUBLISHABLE_KEY_NAME: ${DC_INITIAL_PUBLISHABLE_KEY_NAME:-Storefront Publishable Key}
  HERBATICA_XML_PATH: ${DC_HERBATICA_XML_PATH:-}
  HERBATICA_CATEGORIES_XML_PATH: ${DC_HERBATICA_CATEGORIES_XML_PATH:-}
  HERBATICA_MANUFACTURERS_CSV_PATH: ${DC_HERBATICA_MANUFACTURERS_CSV_PATH:-}
  HERBATICA_REVIEWS_XML_PATH: ${DC_HERBATICA_REVIEWS_XML_PATH:-}

  # Medusa BE: database and schema
  DATABASE_TYPE: postgres
  <<: *medusa-app-db-env
  # Force all Medusa module DB clients (MikroORM/Knex) to use the app schema.
  MEDUSA_DATABASE_SCHEMA: ${DC_MEDUSA_APP_DB_SCHEMA:-medusa}
  DATABASE_SCHEMA: ${DC_MEDUSA_APP_DB_SCHEMA:-medusa}
  # URL-decoded options value is: options=-csearch_path=<schema>,pg_catalog
  # Keep URL encoding when editing manually: %3D is "=", %2C is ","
  DATABASE_URL: postgresql://${DC_MEDUSA_APP_DB_USER:-medusa_app}:${DC_MEDUSA_APP_DB_PASSWORD:-medusa_app_change_me}@${DC_MEDUSA_APP_DB_HOST:-medusa-db}:${DC_MEDUSA_APP_DB_PORT:-5432}/${DC_MEDUSA_APP_DB_NAME:-medusa}?sslmode=${DC_POSTGRES_SSLMODE:-disable}&options=-csearch_path%3D${DC_MEDUSA_APP_DB_SCHEMA:-medusa}%2Cpg_catalog
  LEGACY_DATABASE_URL: ${DC_LEGACY_DATABASE_URL}

  # Medusa BE: dependencies/integrations
  REDIS_URL: ${DC_REDIS_URL:-redis://:${DC_VALKEY_PASSWORD:-valkey_dev_change_me}@medusa-valkey:6379}
  REDIS_SESSIONS_ENABLED: ${DC_MEDUSA_BE_REDIS_SESSIONS_ENABLED:-1}
  CACHE_PROVIDER: ${DC_MEDUSA_BE_CACHE_PROVIDER:-redis}
  EVENT_BUS_PROVIDER: ${DC_MEDUSA_BE_EVENT_BUS_PROVIDER:-redis}
  WORKFLOW_ENGINE_PROVIDER: ${DC_MEDUSA_BE_WORKFLOW_ENGINE_PROVIDER:-redis}
  LOCKING_PROVIDER: ${DC_MEDUSA_BE_LOCKING_PROVIDER:-redis}
  MEILISEARCH_ENABLED: ${DC_MEDUSA_BE_MEILISEARCH_ENABLED:-1}
  MEILISEARCH_HOST: ${DC_MEILISEARCH_HOST}
  MEILISEARCH_API_KEY: ${DC_MEILISEARCH_BACKEND_API_KEY:-}
  FILE_PROVIDER: ${DC_MEDUSA_BE_FILE_PROVIDER:-s3}
  FILE_LOCAL_UPLOAD_DIR: ${DC_MEDUSA_BE_FILE_LOCAL_UPLOAD_DIR:-/tmp/medusa-be-files}
  MINIO_FILE_URL: ${DC_MINIO_FILE_URL}
  MINIO_REGION: ${DC_MINIO_REGION}
  MINIO_ENDPOINT: ${DC_MINIO_ENDPOINT}
  MINIO_BUCKET: ${DC_MINIO_BUCKET}
  MINIO_ACCESS_KEY: ${DC_MINIO_ACCESS_KEY}
  MINIO_SECRET_KEY: ${DC_MINIO_SECRET_KEY}
  # Medusa BE: observability/features
  SENTRY_NAME: ${DC_SENTRY_NAME}
  SENTRY_DSN: ${DC_SENTRY_DSN}
  SENTRY_TRACES_SAMPLE_RATE: ${DC_SENTRY_TRACES_SAMPLE_RATE:-0.1}
  SETTINGS_ENCRYPTION_KEY: ${DC_SETTINGS_ENCRYPTION_KEY}
  CLOUDFLARE_TURNSTILE_ENABLED: ${DC_CLOUDFLARE_TURNSTILE_ENABLED:-0}
  CLOUDFLARE_TURNSTILE_ALLOWED_HOSTNAMES: ${DC_CLOUDFLARE_TURNSTILE_ALLOWED_HOSTNAMES:-}
  MEDUSA_DISABLE_ZBOZI_ACCESS_TOKEN_BOOTSTRAP: ${DC_MEDUSA_DISABLE_ZBOZI_ACCESS_TOKEN_BOOTSTRAP:-0}
  FEATURE_PPL_ENABLED: ${DC_FEATURE_PPL_ENABLED:-0}
  FEATURE_PACKETA_ENABLED: ${DC_FEATURE_PACKETA_ENABLED:-0}
  FEATURE_GLS_ENABLED: ${DC_FEATURE_GLS_ENABLED:-0}
  FEATURE_PAYLOAD_ENABLED: ${DC_FEATURE_PAYLOAD_ENABLED:-0}
  FEATURE_PAYMENT_QR_ENABLED: ${DC_FEATURE_PAYMENT_QR_ENABLED:-0}

  # URL registry lifecycle producer. Keep disabled until URLR migrations,
  # credentials, assignments, and the Herbatika consumer are verified.
  URL_REGISTRY_PRODUCT_LIFECYCLE_ENABLED: ${DC_URL_REGISTRY_PRODUCT_LIFECYCLE_ENABLED:-0}
  URL_REGISTRY_PRODUCT_LIFECYCLE_TOKEN: ${DC_URL_REGISTRY_PRODUCT_LIFECYCLE_TOKEN:-}
  URL_REGISTRY_HERBATIKA_INTERNAL_ORIGIN: ${DC_URL_REGISTRY_HERBATIKA_INTERNAL_ORIGIN:-http://herbatika:3000}
  URL_REGISTRY_PRODUCT_LIFECYCLE_DISPATCH_SCHEDULE: ${DC_URL_REGISTRY_PRODUCT_LIFECYCLE_DISPATCH_SCHEDULE:-* * * * *}
  URL_REGISTRY_CONTENT_PROJECTION_ENABLED: ${DC_URL_REGISTRY_CONTENT_PROJECTION_ENABLED:-0}
  URL_REGISTRY_CONTENT_PROJECTION_URL: ${DC_URL_REGISTRY_CONTENT_PROJECTION_URL:-http://herbatika:3000/api/internal/url-registry/content-projections}
  URL_REGISTRY_CONTENT_PROJECTION_TOKEN: ${DC_URL_REGISTRY_CONTENT_PROJECTION_TOKEN:-}

  # Medusa BE: PayKit payment providers
  FEATURE_PAYKIT_ENABLED: ${DC_FEATURE_PAYKIT_ENABLED:-0}
  FEATURE_PAYKIT_GOPAY_ENABLED: ${DC_FEATURE_PAYKIT_GOPAY_ENABLED:-}
  FEATURE_PAYKIT_STRIPE_ENABLED: ${DC_FEATURE_PAYKIT_STRIPE_ENABLED:-}
  FEATURE_PAYKIT_COMGATE_ENABLED: ${DC_FEATURE_PAYKIT_COMGATE_ENABLED:-}
  PAYKIT_DEBUG: ${DC_PAYKIT_DEBUG:-0}
  GOPAY_CLIENT_ID: ${DC_GOPAY_CLIENT_ID:-}
  GOPAY_CLIENT_SECRET: ${DC_GOPAY_CLIENT_SECRET:-}
  GOPAY_GO_ID: ${DC_GOPAY_GO_ID:-}
  GOPAY_SANDBOX: ${DC_GOPAY_SANDBOX:-true}
  GOPAY_WEBHOOK_URL: ${DC_GOPAY_WEBHOOK_URL:-}
  STRIPE_API_KEY: ${DC_STRIPE_API_KEY:-}
  STRIPE_WEBHOOK_SECRET: ${DC_STRIPE_WEBHOOK_SECRET:-}
  COMGATE_MERCHANT: ${DC_COMGATE_MERCHANT:-}
  COMGATE_SECRET: ${DC_COMGATE_SECRET:-}
  COMGATE_SANDBOX: ${DC_COMGATE_SANDBOX:-true}
  COMGATE_PAYMENT_LABEL: ${DC_COMGATE_PAYMENT_LABEL:-}

  IS_IFRAME_PAYLOAD: ${DC_IS_IFRAME_PAYLOAD:-true}
  PAYLOAD_BASE_URL: ${DC_MEDUSA_PAYLOAD_BASE_URL:-http://payload:8083}
  PAYLOAD_IFRAME_URL: ${DC_PAYLOAD_IFRAME_URL:-http://localhost:8083}
  PAYLOAD_API_KEY: ${DC_PAYLOAD_API_KEY:-}
  PAYLOAD_WEBHOOK_SECRET: ${DC_PAYLOAD_WEBHOOK_SECRET:-}
  CMS_CACHE_TTL: ${DC_CMS_CACHE_TTL:-3600}
  CMS_LIST_CACHE_TTL: ${DC_CMS_LIST_CACHE_TTL:-600}
  PAYLOAD_SSO_PRIVATE_KEY: ${DC_PAYLOAD_SSO_PRIVATE_KEY:-}
  PAYLOAD_SSO_USER_EMAIL: ${DC_PAYLOAD_SSO_USER_EMAIL:-}
  PAYLOAD_SSO_ISSUER: ${DC_PAYLOAD_SSO_ISSUER:-medusa}
  PAYLOAD_SSO_AUDIENCE: ${DC_PAYLOAD_SSO_AUDIENCE:-payload}
  PAYLOAD_SSO_ALG: ${DC_PAYLOAD_SSO_ALG:-RS256}
  PAYLOAD_SSO_TOKEN_TTL: ${DC_PAYLOAD_SSO_TOKEN_TTL:-60}

x-minio-env: &minio-env
  MINIO_ROOT_USER: ${DC_MINIO_ROOT_USER:-minioadmin}
  MINIO_ROOT_PASSWORD: ${DC_MINIO_ROOT_PASSWORD:-minioadmin}
  MINIO_MEDUSA_ACCESS_KEY: ${DC_MINIO_ACCESS_KEY:-medusaappkey}
  MINIO_MEDUSA_SECRET_KEY: ${DC_MINIO_SECRET_KEY:-medusaappsecret_change_me}
  MINIO_MEDUSA_BUCKET: ${DC_MINIO_BUCKET}

x-meilisearch-env: &meilisearch-env
  MEILI_MASTER_KEY: ${DC_MEILISEARCH_MASTER_KEY}
  MEILI_NO_ANALYTICS: true

x-zane-operator-db-env: &zane-operator-db-env
  # zane-operator: postgres connectivity
  PGHOST: medusa-db
  PGPORT: 5432
  PGUSER: ${DC_ZANE_OPERATOR_PGUSER:-zane_operator}
  # Keep optional at interpolation time; runtime entrypoint enforces required values when operator profile is used.
  PGPASSWORD: ${DC_ZANE_OPERATOR_PGPASSWORD:-}
  PGDATABASE: ${DC_ZANE_OPERATOR_PGDATABASE:-postgres}
  PGSSLMODE: ${DC_POSTGRES_SSLMODE:-disable}
  DB_TEMPLATE_NAME: ${DC_ZANE_OPERATOR_DB_TEMPLATE_NAME:-template_medusa}
  DB_PREVIEW_PREFIX: ${DC_ZANE_OPERATOR_DB_PREVIEW_PREFIX:-medusa_pr_}
  DB_PREVIEW_APP_USER_PREFIX: ${DC_ZANE_OPERATOR_DB_PREVIEW_APP_USER_PREFIX:-medusa_pr_app_}
  DB_PREVIEW_DEV_ROLE: ${DC_MEDUSA_DEV_DB_USER:-medusa_dev}
  DB_APP_SCHEMA: ${DC_MEDUSA_APP_DB_SCHEMA:-medusa}
  DB_PREVIEW_APP_PASSWORD_SECRET: ${DC_ZANE_OPERATOR_DB_PREVIEW_APP_PASSWORD_SECRET:-}
  DB_PROTECTED_NAMES: ${DC_ZANE_OPERATOR_DB_PROTECTED_NAMES:-postgres,template0,template1}

x-zane-operator-env: &zane-operator-env
  # zane-operator: service runtime
  PORT: ${DC_ZANE_OPERATOR_PORT:-8080}
  NODE_ENV: ${DC_NODE_ENV:-development}
  API_AUTH_TOKEN: ${DC_ZANE_OPERATOR_API_AUTH_TOKEN:-}
  ZANE_BASE_URL: ${DC_ZANE_OPERATOR_ZANE_BASE_URL:-}
  ZANE_CONNECT_BASE_URL: ${DC_ZANE_OPERATOR_ZANE_CONNECT_BASE_URL:-}
  ZANE_CONNECT_HOST_HEADER: ${DC_ZANE_OPERATOR_ZANE_CONNECT_HOST_HEADER:-}
  ZANE_USERNAME: ${DC_ZANE_OPERATOR_ZANE_USERNAME:-}
  ZANE_PASSWORD: ${DC_ZANE_OPERATOR_ZANE_PASSWORD:-}
  <<: *zane-operator-db-env

x-medusa-base: &medusa-base
  restart: unless-stopped
  container_name: wr_medusa_be
  ports:
    - "127.0.0.1:9000:9000"
    - "127.0.0.1:9009:9009"
    - "127.0.0.1:24678:24678"
  depends_on:
    medusa-db:
      condition: service_healthy
    medusa-valkey:
      condition: service_healthy
    medusa-minio:
      condition: service_healthy
    medusa-meilisearch:
      condition: service_healthy
  networks:
    - internal
  environment:
    <<: *medusa-env

x-n1-env: &n1-env
  # N1: backend connectivity
  MEDUSA_BACKEND_URL_INTERNAL: ${DC_N1_MEDUSA_BACKEND_URL_INTERNAL:-http://medusa-be:9000}
  NEXT_PUBLIC_MEDUSA_BACKEND_URL: ${DC_N1_NEXT_PUBLIC_MEDUSA_BACKEND_URL:-http://localhost:9000}
  NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY: ${DC_N1_NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY:-}

  # N1: search/discovery
  NEXT_PUBLIC_MEILISEARCH_URL: ${DC_N1_NEXT_PUBLIC_MEILISEARCH_URL:-http://localhost:7700}
  NEXT_PUBLIC_MEILISEARCH_API_KEY: ${DC_N1_NEXT_PUBLIC_MEILISEARCH_API_KEY:-}

  # N1: site and tracking
  NEXT_PUBLIC_SITE_URL: ${DC_N1_NEXT_PUBLIC_SITE_URL:-http://localhost:8000}
  NEXT_PUBLIC_META_PIXEL_ID: ${DC_N1_NEXT_PUBLIC_META_PIXEL_ID:-}
  NEXT_PUBLIC_GOOGLE_ADS_ID: ${DC_N1_NEXT_PUBLIC_GOOGLE_ADS_ID:-}
  NEXT_PUBLIC_HEUREKA_API_KEY: ${DC_N1_NEXT_PUBLIC_HEUREKA_API_KEY:-}
  NEXT_PUBLIC_LEADHUB_TRACKING_ID: ${DC_N1_NEXT_PUBLIC_LEADHUB_TRACKING_ID:-}

x-herbatika-env: &herbatika-env
  MEDUSA_BACKEND_URL_INTERNAL: ${DC_HERBATIKA_MEDUSA_BACKEND_URL_INTERNAL:-http://medusa-be:9000}
  NEXT_PUBLIC_MEDUSA_BACKEND_URL: ${DC_HERBATIKA_NEXT_PUBLIC_MEDUSA_BACKEND_URL:-http://localhost:9000}
  NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY: ${DC_HERBATIKA_NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY:-}
  NEXT_PUBLIC_STOREFRONT_AUTH_MODE: ${DC_HERBATIKA_NEXT_PUBLIC_STOREFRONT_AUTH_MODE:-session_proxy}
  NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_ENABLED: ${DC_HERBATIKA_NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_ENABLED:-${DC_CLOUDFLARE_TURNSTILE_ENABLED:-0}}
  PAYLOAD_BASE_URL_INTERNAL: ${DC_HERBATIKA_PAYLOAD_BASE_URL_INTERNAL:-http://payload:8083}
  HERBATIKA_CMS_STATIC_PAGE_IDS: ${DC_HERBATIKA_CMS_STATIC_PAGE_IDS:-}
  NEXT_PUBLIC_PAYLOAD_BASE_URL: ${DC_HERBATIKA_NEXT_PUBLIC_PAYLOAD_BASE_URL:-http://localhost:8083}
  NEXT_PUBLIC_MINIO_FILE_URL: ${DC_HERBATIKA_NEXT_PUBLIC_MINIO_FILE_URL:-http://localhost:9004/medusa-bucket}

  # Issue #545 clean cutover: URLR operational gates remain independent, but
  # URL_ARCHITECTURE_ENABLED is the only public routing control. Never expose
  # this service until the complete architecture can be enabled at once.
  URL_REGISTRY_ENABLED: ${DC_HERBATIKA_URL_REGISTRY_ENABLED:-0}
  URL_REGISTRY_DATABASE_URL: ${DC_HERBATIKA_URL_REGISTRY_DATABASE_URL:-}
  URL_REGISTRY_COMMANDS_ENABLED: ${DC_HERBATIKA_URL_REGISTRY_COMMANDS_ENABLED:-0}
  URL_REGISTRY_ADMIN_TOKEN: ${DC_HERBATIKA_URL_REGISTRY_ADMIN_TOKEN:-}
  URL_REGISTRY_INVALIDATION_ENABLED: ${DC_HERBATIKA_URL_REGISTRY_INVALIDATION_ENABLED:-0}
  URL_REGISTRY_INVALIDATION_TOKEN: ${DC_HERBATIKA_URL_REGISTRY_INVALIDATION_TOKEN:-}
  URL_REGISTRY_INVALIDATION_DISPATCH_ENABLED: ${DC_HERBATIKA_URL_REGISTRY_INVALIDATION_DISPATCH_ENABLED:-0}
  URL_REGISTRY_INVALIDATION_DISPATCH_ORIGIN: ${DC_HERBATIKA_URL_REGISTRY_INVALIDATION_DISPATCH_ORIGIN:-}
  URL_REGISTRY_CONTENT_PROJECTION_ENABLED: ${DC_URL_REGISTRY_CONTENT_PROJECTION_ENABLED:-0}
  URL_REGISTRY_CONTENT_PROJECTION_TOKEN: ${DC_URL_REGISTRY_CONTENT_PROJECTION_TOKEN:-}
  URL_REGISTRY_PRODUCT_LIFECYCLE_ENABLED: ${DC_URL_REGISTRY_PRODUCT_LIFECYCLE_ENABLED:-0}
  URL_REGISTRY_PRODUCT_LIFECYCLE_TOKEN: ${DC_URL_REGISTRY_PRODUCT_LIFECYCLE_TOKEN:-}
  URL_ARCHITECTURE_ENABLED: ${DC_HERBATIKA_URL_ARCHITECTURE_ENABLED:-0}

  # Complete server-only market authority. Publishable key values, key IDs,
  # regions, and sales channels must come from the environment; no public or
  # cross-market fallback is permitted.
  ALLOWED_MARKETS: ${DC_HERBATIKA_ALLOWED_MARKETS:-sk,cz,hu,ro}
  MARKET_ACCEPTED_HOSTS_SK: ${DC_HERBATIKA_MARKET_ACCEPTED_HOSTS_SK:-}
  MARKET_ACCEPTED_HOSTS_CZ: ${DC_HERBATIKA_MARKET_ACCEPTED_HOSTS_CZ:-}
  MARKET_ACCEPTED_HOSTS_HU: ${DC_HERBATIKA_MARKET_ACCEPTED_HOSTS_HU:-}
  MARKET_ACCEPTED_HOSTS_RO: ${DC_HERBATIKA_MARKET_ACCEPTED_HOSTS_RO:-}
  MARKET_PUBLISHABLE_KEY_SK: ${DC_HERBATIKA_MARKET_PUBLISHABLE_KEY_SK:-}
  MARKET_PUBLISHABLE_KEY_CZ: ${DC_HERBATIKA_MARKET_PUBLISHABLE_KEY_CZ:-}
  MARKET_PUBLISHABLE_KEY_HU: ${DC_HERBATIKA_MARKET_PUBLISHABLE_KEY_HU:-}
  MARKET_PUBLISHABLE_KEY_RO: ${DC_HERBATIKA_MARKET_PUBLISHABLE_KEY_RO:-}
  MARKET_PUBLISHABLE_KEY_ID_SK: ${DC_HERBATIKA_MARKET_PUBLISHABLE_KEY_ID_SK:-}
  MARKET_PUBLISHABLE_KEY_ID_CZ: ${DC_HERBATIKA_MARKET_PUBLISHABLE_KEY_ID_CZ:-}
  MARKET_PUBLISHABLE_KEY_ID_HU: ${DC_HERBATIKA_MARKET_PUBLISHABLE_KEY_ID_HU:-}
  MARKET_PUBLISHABLE_KEY_ID_RO: ${DC_HERBATIKA_MARKET_PUBLISHABLE_KEY_ID_RO:-}
  MARKET_REGION_SK: ${DC_HERBATIKA_MARKET_REGION_SK:-}
  MARKET_REGION_CZ: ${DC_HERBATIKA_MARKET_REGION_CZ:-}
  MARKET_REGION_HU: ${DC_HERBATIKA_MARKET_REGION_HU:-}
  MARKET_REGION_RO: ${DC_HERBATIKA_MARKET_REGION_RO:-}
  MARKET_SALES_CHANNEL_SK: ${DC_HERBATIKA_MARKET_SALES_CHANNEL_SK:-}
  MARKET_SALES_CHANNEL_CZ: ${DC_HERBATIKA_MARKET_SALES_CHANNEL_CZ:-}
  MARKET_SALES_CHANNEL_HU: ${DC_HERBATIKA_MARKET_SALES_CHANNEL_HU:-}
  MARKET_SALES_CHANNEL_RO: ${DC_HERBATIKA_MARKET_SALES_CHANNEL_RO:-}

x-payload-env: &payload-env
  DATABASE_URL: ${DC_PAYLOAD_DATABASE_URL:-postgresql://${DC_PAYLOAD_DATABASE_USER:-payload}:${DC_PAYLOAD_DATABASE_PASSWORD:-payload}@medusa-db:5432/${DC_MEDUSA_APP_DB_NAME:-medusa}?sslmode=${DC_POSTGRES_SSLMODE:-disable}&options=-csearch_path%3D${DC_PAYLOAD_DATABASE_SCHEMA_NAME:-payload}%2Cpg_catalog}
  PAYLOAD_SECRET: ${DC_PAYLOAD_SECRET:-payload_secret_change_me}
  PAYLOAD_SCHEMA_NAME: ${DC_PAYLOAD_DATABASE_SCHEMA_NAME:-payload}
  PAYLOAD_BASE_URL: ${DC_PAYLOAD_BASE_URL:-http://localhost:8083}
  MEDUSA_BACKEND_URL: ${DC_FE_MEDUSA_BACKEND_URL:-http://medusa-be:9000}
  PAYLOAD_MEDUSA_PUBLISHABLE_KEY: ${DC_PAYLOAD_MEDUSA_PUBLISHABLE_KEY:-${DC_HERBATIKA_NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY:-${DC_N1_NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY:-}}}
  FEATURE_PAYLOAD_ARTICLES_ENABLED: ${DC_FEATURE_PAYLOAD_ARTICLES_ENABLED:-1}
  FEATURE_PAYLOAD_PAGES_ENABLED: ${DC_FEATURE_PAYLOAD_PAGES_ENABLED:-1}
  FEATURE_PAYLOAD_HERO_CAROUSELS_ENABLED: ${DC_FEATURE_PAYLOAD_HERO_CAROUSELS_ENABLED:-1}
  PAYLOAD_WEBHOOK_SECRET: ${DC_PAYLOAD_WEBHOOK_SECRET:-}
  PAYLOAD_API_KEY: ${DC_PAYLOAD_API_KEY:-}
  PAYLOAD_LOCALES: ${DC_PAYLOAD_LOCALES:-cs,sk,hu,ro}
  PAYLOAD_SEED_ON_STARTUP: ${DC_PAYLOAD_SEED_ON_STARTUP:-0}
  HERBATICA_XML_PATH: ${DC_HERBATIKA_XML_PATH:-}
  # Customer runtimes must opt into starter and product fixture content.
  PAYLOAD_SEED_STARTER_CONTENT_ENABLED: ${DC_PAYLOAD_SEED_STARTER_CONTENT_ENABLED:-0}
  PAYLOAD_SEED_HERBATICA_PRODUCTS_ENABLED: ${DC_PAYLOAD_SEED_HERBATICA_PRODUCTS_ENABLED:-0}
  PAYLOAD_SEED_HERBATICA_PRODUCTS_LIMIT: ${DC_PAYLOAD_SEED_HERBATICA_PRODUCTS_LIMIT:-}
  HERBATICA_BLOG_ARTICLES_XLSX_PATH: ${DC_HERBATICA_BLOG_ARTICLES_XLSX_PATH:-}
  PAYLOAD_SEED_ARTICLES_XLSX_PATH: ${DC_PAYLOAD_SEED_ARTICLES_XLSX_PATH:-}
  PAYLOAD_SEED_ARTICLES_SHEET: ${DC_PAYLOAD_SEED_ARTICLES_SHEET:-}
  PAYLOAD_SEED_ARTICLES_LOCALE: ${DC_PAYLOAD_SEED_ARTICLES_LOCALE:-}
  PAYLOAD_SEED_ARTICLES_STATUS: ${DC_PAYLOAD_SEED_ARTICLES_STATUS:-}
  PAYLOAD_SEED_ARTICLES_TRANSLATE: ${DC_PAYLOAD_SEED_ARTICLES_TRANSLATE:-0}
  PAYLOAD_SEED_ARTICLES_OVERWRITE: ${DC_PAYLOAD_SEED_ARTICLES_OVERWRITE:-0}
  PAYLOAD_SSO_USER_EMAIL: ${DC_PAYLOAD_SSO_USER_EMAIL}
  PAYLOAD_SSO_PRIVATE_KEY: ${DC_PAYLOAD_SSO_PRIVATE_KEY}
  PAYLOAD_SSO_PUBLIC_KEY: ${DC_PAYLOAD_SSO_PUBLIC_KEY:-}
  PAYLOAD_SSO_ISSUER: ${DC_PAYLOAD_SSO_ISSUER:-medusa}
  PAYLOAD_SSO_AUDIENCE: ${DC_PAYLOAD_SSO_AUDIENCE:-payload}
  PAYLOAD_SSO_ALG: ${DC_PAYLOAD_SSO_ALG:-RS256}
  PAYLOAD_SSO_ALLOWED_ORIGINS: ${DC_PAYLOAD_SSO_ALLOWED_ORIGINS:-http://localhost:5173,http://127.0.0.1:5173,http://localhost:9000,http://127.0.0.1:9000,https://admin.medusa.localhost}
  OPENAI_API_KEY: ${DC_OPENAI_API_KEY:-}
  S3_ENDPOINT: ${DC_PAYLOAD_S3_ENDPOINT:-http://medusa-minio:9004}
  S3_REGION: ${DC_PAYLOAD_S3_REGION:-us-east-1}
  S3_BUCKET: ${DC_PAYLOAD_S3_BUCKET:-medusa-bucket}
  S3_ACCESS_KEY_ID: ${DC_PAYLOAD_S3_ACCESS_KEY_ID:-minioadmin}
  S3_SECRET_ACCESS_KEY: ${DC_PAYLOAD_S3_SECRET_ACCESS_KEY:-minioadmin}

services:
  # DEV MODE (default): docker compose up
  # PROD MODE: docker compose -f docker-compose.yaml -f docker-compose.prod.yaml up --build
  medusa-be:
    <<: *medusa-base
    build:
      context: .
      dockerfile: docker/development/medusa-be/Dockerfile
      target: dev
      args:
        FEATURE_PPL_ENABLED: ${DC_FEATURE_PPL_ENABLED:-0}
        FEATURE_PACKETA_ENABLED: ${DC_FEATURE_PACKETA_ENABLED:-0}
        FEATURE_GLS_ENABLED: ${DC_FEATURE_GLS_ENABLED:-0}
        FEATURE_PAYLOAD_ENABLED: ${DC_FEATURE_PAYLOAD_ENABLED:-0}
    volumes:
      - .:/var/www
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:9000/health" ]
      start_period: 60s
      interval: 15s
      timeout: 10s
      retries: 8
  payload:
    restart: unless-stopped
    container_name: wr_payload
    build:
      context: .
      dockerfile: docker/development/payload/Dockerfile
      target: dev
    working_dir: /var/www
    command: ["payload-runtime", "devsafe"]
    depends_on:
      medusa-db:
        condition: service_healthy
      medusa-minio:
        condition: service_healthy
    ports:
      - "127.0.0.1:8083:8083"
    networks:
      - internal
    environment:
      <<: *payload-env
      NODE_ENV: development
    volumes:
      - .:/var/www
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:8083/api/health" ]
      start_period: 30s
      interval: 30s
      timeout: 10s
      retries: 5
  n1:
    restart: unless-stopped
    container_name: wr_n1
    build:
      context: .
      dockerfile: docker/development/n1/Dockerfile
      target: dev
      args:
        NEXT_PUBLIC_MEDUSA_BACKEND_URL: ${DC_N1_NEXT_PUBLIC_MEDUSA_BACKEND_URL:-http://localhost:9000}
        NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY: ${DC_N1_NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY:-}
    depends_on:
      medusa-be:
        condition: service_healthy
    ports:
      - "127.0.0.1:8000:3000"
    networks:
      - internal
    environment:
      <<: *n1-env
      NODE_ENV: development
    volumes:
      - .:/var/www
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:3000/api/health" ]
      start_period: 30s
      interval: 30s
      retries: 5
  herbatika:
    restart: unless-stopped
    container_name: wr_herbatika
    build:
      context: .
      dockerfile: docker/development/herbatika/Dockerfile
      target: dev
      args:
        NEXT_PUBLIC_MEDUSA_BACKEND_URL: ${DC_HERBATIKA_NEXT_PUBLIC_MEDUSA_BACKEND_URL:-http://localhost:9000}
        NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY: ${DC_HERBATIKA_NEXT_PUBLIC_MEDUSA_PUBLISHABLE_KEY:-}
        NEXT_PUBLIC_STOREFRONT_AUTH_MODE: ${DC_HERBATIKA_NEXT_PUBLIC_STOREFRONT_AUTH_MODE:-session_proxy}
        NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_ENABLED: ${DC_HERBATIKA_NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_ENABLED:-${DC_CLOUDFLARE_TURNSTILE_ENABLED:-0}}
        NEXT_PUBLIC_PAYLOAD_BASE_URL: ${DC_HERBATIKA_NEXT_PUBLIC_PAYLOAD_BASE_URL:-http://localhost:8083}
        NEXT_PUBLIC_MINIO_FILE_URL: ${DC_HERBATIKA_NEXT_PUBLIC_MINIO_FILE_URL:-http://localhost:9004/medusa-bucket}
    depends_on:
      medusa-be:
        condition: service_healthy
    ports:
      - "127.0.0.1:${DC_HERBATIKA_PUBLIC_PORT:-3001}:3000"
    networks:
      - internal
    environment:
      <<: *herbatika-env
      NODE_ENV: development
    volumes:
      - .:/var/www
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:3000" ]
      start_period: 30s
      interval: 30s
      timeout: 10s
      retries: 5
  medusa-valkey:
    build:
      context: ./docker/development/medusa-valkey
      dockerfile: Dockerfile
    command: [ "sh", "-lc", "exec valkey-server --requirepass \"$$VALKEY_PASSWORD\" --appendonly yes" ]
    container_name: wr_medusa_valkey
    healthcheck:
      test: [ "CMD-SHELL", "valkey-cli -a \"$${VALKEY_PASSWORD}\" --no-auth-warning ping | grep -q PONG" ]
      start_period: 5s
      timeout: 3s
      interval: 1s
      retries: 5
    ports:
      - "127.0.0.1:6379:6379"
    volumes:
      - medusa-valkey-data:/data
    networks:
      - internal
    environment:
      VALKEY_PASSWORD: ${DC_VALKEY_PASSWORD:-valkey_dev_change_me}
  medusa-minio:
    build:
      context: ./docker/development/medusa-minio
      dockerfile: Dockerfile
    container_name: wr_medusa_minio
    ports:
      - "127.0.0.1:9003:9003"
      - "127.0.0.1:9004:9004"
    volumes:
      - medusa-minio-data:/data
    networks:
      - internal
    command: server /data --console-address ":9003" --address :9004
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:9004/minio/health/live" ]
    environment:
      <<: *minio-env
  medusa-meilisearch:
    build:
      context: ./docker/development/medusa-meilisearch
      dockerfile: Dockerfile
    container_name: wr_medusa_meilisearch
    ports:
      - "127.0.0.1:7700:7700"
    volumes:
      - medusa-meilisearch-data:/meili_data
    networks:
      - internal
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:7700/health" ]
      interval: 10s
      timeout: 5s
      retries: 5
    environment:
      <<: *meilisearch-env
  medusa-db:
    build:
      context: ./docker/development/postgres
      dockerfile: Dockerfile
    restart: unless-stopped
    command: [ "/usr/local/bin/run-postgres-with-bootstrap.sh" ]
    ports:
      - "127.0.0.1:${DC_POSTGRES_PUBLIC_PORT:-5432}:5432"
    volumes:
      - ${DC_POSTGRES_VOLUME_DATA:-./.docker_data/db18}:/var/lib/postgresql
    networks:
      - internal
    healthcheck:
      test: [ "CMD", "/usr/local/bin/postgres-ready-with-bootstrap.sh" ]
      start_period: 10s
      interval: 30s
      timeout: 60s
      retries: 3
    environment:
      <<: *medusa-bootstrap-db-env
      POSTGRES_PASSWORD: ${DC_POSTGRES_SUPERUSER_PASSWORD:-root}
      POSTGRES_USER: ${DC_POSTGRES_SUPERUSER:-root}
      POSTGRES_DB: ${DC_MEDUSA_APP_DB_NAME:-medusa}
      PGDATA: /var/lib/postgresql/18/docker
  zane-operator:
    profiles: [ "operator" ]
    restart: unless-stopped
    build:
      context: .
      dockerfile: docker/development/zane-operator/Dockerfile
      target: dev
    entrypoint:
      - /bin/sh
      - -ec
      - |
        [ -n "$$API_AUTH_TOKEN" ] || { echo "Missing required env: API_AUTH_TOKEN. Set DC_ZANE_OPERATOR_API_AUTH_TOKEN." >&2; exit 1; }
        [ -n "$$PGUSER" ] || { echo "Missing required env: PGUSER. Set DC_ZANE_OPERATOR_PGUSER." >&2; exit 1; }
        [ -n "$$PGPASSWORD" ] || { echo "Missing required env: PGPASSWORD. Set DC_ZANE_OPERATOR_PGPASSWORD." >&2; exit 1; }
        [ -n "$$DB_PREVIEW_APP_PASSWORD_SECRET" ] || { echo "Missing required env: DB_PREVIEW_APP_PASSWORD_SECRET. Set DC_ZANE_OPERATOR_DB_PREVIEW_APP_PASSWORD_SECRET." >&2; exit 1; }
        exec sh -lc "$${ZANE_OPERATOR_RUNTIME_COMMAND:-pnpm --dir apps/zane-operator dev}"
    depends_on:
      medusa-db:
        condition: service_healthy
    ports:
      - "127.0.0.1:${DC_ZANE_OPERATOR_PUBLIC_PORT:-8082}:${DC_ZANE_OPERATOR_PORT:-8080}"
    networks:
      - internal
    environment:
      <<: *zane-operator-env
    volumes:
      - .:/var/www
  engine-db:
    image: mariadb:latest
    restart: no
    environment:
      MYSQL_ROOT_PASSWORD: 1234
      MYSQL_DATABASE: wrshop
      MYSQL_USER: wruser
      MYSQL_PASSWORD: 1234
    command: --sql_mode="NO_ENGINE_SUBSTITUTION"
    ports:
      - "127.0.0.1:3306:3306"
    volumes:
      - ./.docker_data/dbmysql:/var/lib/mysql
      - ./docker/development/mariadb/wr.cnf:/etc/mysql/conf.d/wr.cnf
    networks:
      - internal
  adminer:
    image: adminer
    restart: unless-stopped
    ports:
      - "127.0.0.1:8081:8080"
    depends_on:
      - medusa-db
    networks:
      - internal
    environment:
      ADMINER_DESIGN: nette
      ADMINER_DEFAULT_SERVER: medusa-db
      ADMINER_PLUGINS: "dump-json"
  caddy:
    build:
      context: ./docker/development/caddy
      dockerfile: Dockerfile
    cap_add:
      - NET_ADMIN
    ports:
      - "127.0.0.1:80:80"
      - "127.0.0.1:443:443"
      - "127.0.0.1:443:443/udp"
    networks:
      - internal
    volumes:
      - ./docker/development/caddy/Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    extra_hosts:
      - host.docker.internal:host-gateway
networks:
  internal:
    driver: bridge

volumes:
  medusa-valkey-data:
  medusa-minio-data:
  medusa-meilisearch-data:
  caddy_data:
  caddy_config: