demat-facturation/docker-compose.yml

services:
  # ============================================================
  # MySQL Database
  # ============================================================
  demat-facturation-db:
    image: mysql:8.0
    container_name: demat-facturation-db
    restart: unless-stopped
    command: --innodb-use-native-aio=0 --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci
    environment:
      MYSQL_ROOT_PASSWORD: demat_facturation_db_pass_2026
      MYSQL_DATABASE: gestion_facturation
    volumes:
      - demat_facturation_mysql_data:/var/lib/mysql
    networks:
      - demat-facturation-internal
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "root", "-pdemat_facturation_db_pass_2026"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  # ============================================================
  # Migration versionnée (lancée explicitement avec le profil migration)
  # ============================================================
  demat-facturation-migrate:
    build:
      context: .
      dockerfile: Dockerfile
      target: builder
    command: ["./node_modules/.bin/drizzle-kit", "migrate"]
    depends_on:
      demat-facturation-db:
        condition: service_healthy
    environment:
      DATABASE_URL: mysql://root:demat_facturation_db_pass_2026@demat-facturation-db:3306/gestion_facturation
    networks:
      - demat-facturation-internal
    profiles: ["migration"]
    restart: "no"

  # ============================================================
  # Application (Backend + Frontend)
  # ============================================================
  demat-facturation-app:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: demat-facturation-app
    restart: unless-stopped
    depends_on:
      demat-facturation-db:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: 3000
      DATABASE_URL: mysql://root:demat_facturation_db_pass_2026@demat-facturation-db:3306/gestion_facturation
      JWT_SECRET: demat-facturation-jwt-secret-recette-2026
      MISTRAL_API_KEY: ${MISTRAL_API_KEY:-}
      # Passerelle centralisée : le jeton reste dans l'environnement serveur.
      REFERENTIEL_IA_URL: ${REFERENTIEL_IA_URL:-https://referentiel-ia-santinova.recette.santinova-soft.org}
      REFERENTIEL_IA_TOKEN: ${REFERENTIEL_IA_TOKEN:-}
      REFERENTIEL_IA_TOKEN_FILE: /run/secrets/referentiel_ia_token
      UPLOAD_DIR: /app/uploads
      # Chemin unique utilisé par le serveur et vérifié au démarrage.
      STORAGE_BASE_PATH: /app/storage
      # Le déploiement Santinova requiert le volume historique des PDF.
      REQUIRE_STORAGE_VOLUME: "true"
      # Manus OAuth (optionnel en recette)
      VITE_APP_ID: ${VITE_APP_ID:-demat-facturation-recette}
      OAUTH_SERVER_URL: ${OAUTH_SERVER_URL:-}
      VITE_OAUTH_PORTAL_URL: ${VITE_OAUTH_PORTAL_URL:-}
      OWNER_OPEN_ID: ${OWNER_OPEN_ID:-}
      OWNER_NAME: ${OWNER_NAME:-Administrateur}
    volumes:
      - demat_facturation_uploads:/app/uploads
      # Les factures source et leurs métadonnées sont servies sous /storage.
      # Il est externe et n'est donc jamais recréé ni supprimé par Compose.
      - type: volume
        source: demat_facturation_storage
        target: /app/storage
        volume:
          nocopy: true
    secrets:
      - source: referentiel_ia_token
        target: referentiel_ia_token
        mode: 0400
    # L’application doit utiliser eth0 sur le réseau de données ; l’ordre évite
    # toute inversion d’interface lors d’une recréation Docker multi-réseaux.
    networks:
      demat-facturation-internal:
        priority: 1000
      web:
        priority: 100
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.demat-facturation.rule=Host(`demat-facturation.recette.santinova-soft.org`) || Host(`demat-facturation-santinova.recette.santinova-soft.org`)"
      - "traefik.http.routers.demat-facturation.entrypoints=websecure"
      - "traefik.http.routers.demat-facturation.tls.certresolver=letsencrypt"
      - "traefik.http.services.demat-facturation.loadbalancer.server.port=3000"
    healthcheck:
      test: ["CMD-SHELL", "grep -qs ' /app/storage ' /proc/mounts && test -w /app/storage && curl -fsS http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

volumes:
  demat_facturation_mysql_data:
    driver: local
  demat_facturation_uploads:
    driver: local
  demat_facturation_storage:
    external: true
    name: ${STORAGE_VOLUME_NAME:-demat-facturation-dsi_demat_facturation_storage}

secrets:
  referentiel_ia_token:
    file: /opt/manus-secrets/demat-facturation-referentiel-ia-token

networks:
  demat-facturation-internal:
    driver: bridge
  web:
    external: true