# Production overrides for docker-compose.openzaak.yml: real secrets, real DB auth,
# HTTPS-aware settings. Use ON TOP of the base file, never alone (it has no image/ports of its
# own to add — see backend/openzaak/README.md for the required env vars and full flow):
#
#   ./render-prod-secrets.sh   # renders setup_configuration/data.prod.yaml (gitignored)
#   docker compose -f docker-compose.openzaak.yml -f docker-compose.openzaak.prod.yml up -d
#
# TLS is NOT terminated here — OpenZaak sits behind a reverse proxy/ingress that owns the
# certificate; this file only tells OpenZaak (via IS_HTTPS) that it's being served over HTTPS
# so it sets secure cookies / redirects correctly.
services:
  db:
    environment:
      - POSTGRES_HOST_AUTH_METHOD=md5
      - POSTGRES_PASSWORD=${OPENZAAK_DB_PASSWORD:?OPENZAAK_DB_PASSWORD must be set}

  web-init:
    environment:
      SECRET_KEY: ${OPENZAAK_SECRET_KEY:?OPENZAAK_SECRET_KEY must be set}
      DB_PASSWORD: ${OPENZAAK_DB_PASSWORD:?OPENZAAK_DB_PASSWORD must be set}
      IS_HTTPS: 'yes'
      SITE_DOMAIN: ${OPENZAAK_SITE_DOMAIN:?OPENZAAK_SITE_DOMAIN must be set}
      ALLOWED_HOSTS: ${OPENZAAK_ALLOWED_HOSTS:?OPENZAAK_ALLOWED_HOSTS must be set}
      DISABLE_2FA: 'false'
    volumes:
      # Shadows the dev data.yaml (still mounted read-only from the base file) with the
      # secret-free template rendered by render-prod-secrets.sh.
      - ./setup_configuration/data.prod.yaml:/app/setup_configuration/data.yaml:ro

  web:
    environment:
      SECRET_KEY: ${OPENZAAK_SECRET_KEY:?OPENZAAK_SECRET_KEY must be set}
      DB_PASSWORD: ${OPENZAAK_DB_PASSWORD:?OPENZAAK_DB_PASSWORD must be set}
      IS_HTTPS: 'yes'
      SITE_DOMAIN: ${OPENZAAK_SITE_DOMAIN:?OPENZAAK_SITE_DOMAIN must be set}
      ALLOWED_HOSTS: ${OPENZAAK_ALLOWED_HOSTS:?OPENZAAK_ALLOWED_HOSTS must be set}
      DISABLE_2FA: 'false'