services:
  landing:
    build:
      context: ./landing
      dockerfile: Dockerfile
    container_name: ai-portal-landing
    restart: unless-stopped
    ports:
      - "127.0.0.1:3010:3010"
      - "100.95.104.123:3010:3010"  # Tailscale (t6)
    environment:
      AUTH_SECRET: ${AUTH_SECRET:?set AUTH_SECRET in .env}
      AUTH_TRUST_HOST: "true"
      NEXTAUTH_URL: ${NEXTAUTH_URL:-https://ai.klas.chat}
      DEV_PORTAL_PASSWORD: ${DEV_PORTAL_PASSWORD:-}
      AUTH_MICROSOFT_ENTRA_ID_ID: ${AUTH_MICROSOFT_ENTRA_ID_ID:-}
      AUTH_MICROSOFT_ENTRA_ID_SECRET: ${AUTH_MICROSOFT_ENTRA_ID_SECRET:-}
      AUTH_MICROSOFT_ENTRA_ID_ISSUER: ${AUTH_MICROSOFT_ENTRA_ID_ISSUER:-}
    networks:
      - localai

  # Langfuse observability stack (optional for v1 — uncomment when ready).
  # Reference: https://langfuse.com/self-hosting/docker-compose
  #
  # langfuse-db:
  #   image: postgres:16
  #   container_name: ai-portal-langfuse-db
  #   restart: unless-stopped
  #   environment:
  #     POSTGRES_USER: langfuse
  #     POSTGRES_PASSWORD: ${LANGFUSE_DB_PASSWORD}
  #     POSTGRES_DB: langfuse
  #   volumes:
  #     - langfuse-db:/var/lib/postgresql/data
  #   networks:
  #     - localai
  #
  # langfuse:
  #   image: langfuse/langfuse:2
  #   container_name: ai-portal-langfuse
  #   restart: unless-stopped
  #   depends_on:
  #     - langfuse-db
  #   ports:
  #     - "127.0.0.1:3011:3000"
  #   environment:
  #     DATABASE_URL: postgresql://langfuse:${LANGFUSE_DB_PASSWORD}@langfuse-db:5432/langfuse
  #     NEXTAUTH_URL: https://langfuse.klas.chat
  #     NEXTAUTH_SECRET: ${LANGFUSE_NEXTAUTH_SECRET}
  #     SALT: ${LANGFUSE_SALT}
  #     TELEMETRY_ENABLED: "false"
  #   networks:
  #     - localai

# volumes:
#   langfuse-db:

networks:
  localai:
    external: true