docker-compose.yml

services:
  db:
    image: mysql:8.0
    command: ["--default-authentication-plugin=mysql_native_password"]
    environment:
      MYSQL_ROOT_PASSWORD: root
      MYSQL_DATABASE: rsyslogdb
      MYSQL_USER: rsyslog
      MYSQL_PASSWORD: rsyslog
    volumes:
      - db-data:/var/lib/mysql
      - ./docker/mysql/init:/docker-entrypoint-initdb.d:ro
    ports:
      # Host 3306 → container 3306 (standard MySQL port for external ommysql / host tools)
      - "${MYSQL_HOST_PORT:-3306}:3306"

  rsyslog:
    build: ./docker/rsyslog
    depends_on:
      - db
    environment:
      RSYSLOG_DB_HOST: db
      RSYSLOG_DB_PORT: 3306
      RSYSLOG_DB_NAME: rsyslogdb
      RSYSLOG_DB_USER: rsyslog
      RSYSLOG_DB_PASSWORD: rsyslog
      RSYSLOG_INGEST_PORT: 5514
    ports:
      - "${RSYSLOG_INGEST_PORT:-5514}:5514/tcp"
      - "${RSYSLOG_INGEST_PORT:-5514}:5514/udp"

  web:
    build: .
    # Mount source so JS/CSS/PHP edits apply without rebuilding (e2e + local dev).
    volumes:
      - .:/var/www/html
      # Keep Composer dependencies when bind-mounting the repo (vendor/ is gitignored).
      - web-vendor:/var/www/html/vendor
    depends_on:
      - db
    environment:
      RSYSLOG_DB_HOST: db
      RSYSLOG_DB_NAME: rsyslogdb
      RSYSLOG_DB_USER: rsyslog
      RSYSLOG_DB_PASSWORD: rsyslog
      RSYSLOG_SITE_NAME: System Logs
      RSYSLOG_KEEP_DAYS: 90
      RSYSLOG_AUTH_ENABLED: "1"
      RSYSLOG_SESSION_SECRET: "dev-session-secret-change-me"
      RSYSLOG_ADMIN_USERNAME: "admin"
      RSYSLOG_ADMIN_PASSWORD: "admin123"
      # Playwright / local iteration: avoid locking out admin after repeated test logins
      RSYSLOG_LOGIN_RATE_LIMIT: "0"
      # E2E bootstrap (json/e2e-bootstrap.php): Docker dev only; requires tests/e2e/.e2e-bootstrap-token from Playwright
      RSYSLOG_E2E_ENABLED: "1"
      # Optional Microsoft Entra ID (see README):
      # RSYSLOG_AZURE_ENABLED: "1"
      # RSYSLOG_AZURE_TENANT_ID: "your-tenant-guid"
      # RSYSLOG_AZURE_CLIENT_ID: "your-app-client-id"
      # RSYSLOG_AZURE_CLIENT_SECRET: "your-secret"
      # RSYSLOG_AZURE_REDIRECT_URI: "https://your-host/auth/azure/callback.php"
      # RSYSLOG_AZURE_ADMIN_GROUP_ID: "optional-group-object-id"
    ports:
      - "${WEB_PORT:-8080}:80"
    networks:
      - default
      - edge

  # Terminates TLS on host 80/443 (Let's Encrypt DNS-01 via Cloudflare).
  # Default: copy docker/tls.env.example → .env.tls (includes COMPOSE_PROFILES=tls), then:
  #   docker compose --env-file .env.tls up -d --build
  # Without COMPOSE_PROFILES in env: add --profile tls. Or use docker-compose.tls.yml.
  traefik:
    profiles:
      - tls
    image: traefik:v3.3
    restart: unless-stopped
    depends_on:
      - web
    ports:
      - "80:80"
      - "443:443"
    environment:
      CF_DNS_API_TOKEN: ${CF_DNS_API_TOKEN:-}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-letsencrypt:/letsencrypt
      - ./docker/traefik-dynamic.tls.yml:/etc/traefik/dynamic/traefik-dynamic.tls.yml:ro
    command:
      - --providers.docker=false
      - --log.level=INFO
      - --providers.file.directory=/etc/traefik/dynamic
      - --providers.file.watch=true
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --certificatesresolvers.cf.acme.dnschallenge=true
      - --certificatesresolvers.cf.acme.dnschallenge.provider=cloudflare
      - --certificatesresolvers.cf.acme.email=${ACME_EMAIL}
      - --certificatesresolvers.cf.acme.storage=/letsencrypt/acme.json
    networks:
      - edge

networks:
  edge:
    driver: bridge

volumes:
  db-data:
  web-vendor:
  traefik-letsencrypt: