Primeira varredura, em 2 minutos.

services:

  # ── PostgreSQL ────────────────────────────────────────────
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER:     ${POSTGRES_USER:-wafpass}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-wafpass}
      POSTGRES_DB:       ${POSTGRES_DB:-wafpass}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./keycloak/init.sql:/docker-entrypoint-initdb.d/01-keycloak-db.sql:ro
    ports:
      - "${POSTGRES_PORT:-5432}:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-wafpass} -d ${POSTGRES_DB:-wafpass}"]
      interval: 5s
      timeout: 5s
      retries: 10

  # ── wafpass-server ────────────────────────────────────────
  wafpass-server:
    build:
      context: .
      dockerfile: wafpass-server/Dockerfile
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      DATABASE_URL:               postgresql+asyncpg://${POSTGRES_USER:-wafpass}:${POSTGRES_PASSWORD:-wafpass}@postgres:5432/${POSTGRES_DB:-wafpass}
      WAFPASS_ENV:                ${WAFPASS_ENV:-local}
      CORS_ORIGINS:               ${API_URL:-http://localhost:3000},http://wafpass-dashboard,http://cloud.waf2p
      WAFPASS_CONTROLS_DIR:       ${WAFPASS_CONTROLS_DIR:-/app/controls}
      WAFPASS_JWT_SECRET:         ${WAFPASS_JWT_SECRET:-change-me-in-production}
      WAFPASS_JWT_EXPIRE_MINUTES: ${WAFPASS_JWT_EXPIRE_MINUTES:-60}
      WAFPASS_JWT_REFRESH_DAYS:   ${WAFPASS_JWT_REFRESH_DAYS:-7}
      WAFPASS_ADMIN_USERNAME:     ${WAFPASS_ADMIN_USERNAME:-admin}
      WAFPASS_ADMIN_PASSWORD:     ${WAFPASS_ADMIN_PASSWORD:-admin}
      WAFPASS_ADMIN_ROLE:         ${WAFPASS_ADMIN_ROLE:-admin}
      WAFPASS_API_KEY:            ${WAFPASS_API_KEY:-key}
    ports:
      - "8000:8000"

  # ── Keycloak (SSO / IdP — dev mode) ──────────────────────
  keycloak:
    image: quay.io/keycloak/keycloak:26.1
    command: start-dev
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      KC_DB:                   postgres
      KC_DB_URL:               jdbc:postgresql://postgres:5432/${KEYCLOAK_DB:-keycloak}
      KC_DB_USERNAME:          ${KEYCLOAK_DB_USER:-keycloak}
      KC_DB_PASSWORD:          ${KEYCLOAK_DB_PASSWORD:-keycloak}
      KEYCLOAK_ADMIN:          ${KEYCLOAK_ADMIN_USER:-admin}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
      KC_HTTP_ENABLED:         "true"
      KC_HOSTNAME_STRICT:      "false"
      KC_HEALTH_ENABLED:       "true"
    ports:
      - "${KEYCLOAK_PORT:-8080}:8080"
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8080/health/ready || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 20
      start_period: 60s

  # ── wafpass-dashboard ─────────────────────────────────────
  wafpass-dashboard:
    build:
      context: ./wafpass-dashboard
      dockerfile: Dockerfile
    restart: unless-stopped
    depends_on:
      - wafpass-server
    ports:
      - "3000:80"

volumes:
  postgres_data: