version: '3.8'

services:
  wordpress:
    image: wordpress:6.7-php8.3-apache
    container_name: ${SITE_NAME:-wordpress}
    restart: unless-stopped
    environment:
      WORDPRESS_DB_HOST: mariadb:3306
      WORDPRESS_DB_USER: ${DB_USER:-wordpress}
      WORDPRESS_DB_PASSWORD: ${DB_PASSWORD}
      WORDPRESS_DB_NAME: ${DB_NAME:-wordpress}
      WORDPRESS_TABLE_PREFIX: ${TABLE_PREFIX:-wp_}
      # Optional performance tuning
      WORDPRESS_CONFIG_EXTRA: |
        define('WP_MEMORY_LIMIT', '256M');
        define('WP_MAX_MEMORY_LIMIT', '512M');
        define('WP_HOME', 'https://${DOMAIN}');
        define('WP_SITEURL', 'https://${DOMAIN}');
        # Disable auto-updates during migration
        define('AUTOMATIC_UPDATER_DISABLED', true);
        define('WP_AUTO_UPDATE_CORE', false);
    volumes:
      # Persistent storage for WordPress files
      - ./wp-content:/var/www/html/wp-content
      - ./uploads.ini:/usr/local/etc/php/conf.d/uploads.ini
    networks:
      - internal
      - traefik
    depends_on:
      mariadb:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      # HTTP Router
      - "traefik.http.routers.${SITE_NAME:-wordpress}.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.${SITE_NAME:-wordpress}.entrypoints=web"
      - "traefik.http.routers.${SITE_NAME:-wordpress}.middlewares=redirect-to-https@file"
      # HTTPS Router
      - "traefik.http.routers.${SITE_NAME:-wordpress}-secure.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.${SITE_NAME:-wordpress}-secure.entrypoints=websecure"
      - "traefik.http.routers.${SITE_NAME:-wordpress}-secure.tls=true"
      - "traefik.http.routers.${SITE_NAME:-wordpress}-secure.tls.certresolver=letsencrypt"
      - "traefik.http.services.${SITE_NAME:-wordpress}.loadbalancer.server.port=80"

  mariadb:
    image: mariadb:10.7
    container_name: ${SITE_NAME:-wordpress}_db
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      MYSQL_DATABASE: ${DB_NAME:-wordpress}
      MYSQL_USER: ${DB_USER:-wordpress}
      MYSQL_PASSWORD: ${DB_PASSWORD}
      # Performance tuning
      MARIADB_AUTO_UPGRADE: "1"
      MARIADB_INITDB_SKIP_TZINFO: "1"
    volumes:
      # Persistent database storage
      - ./db_data:/var/lib/mysql
      # Optional: Custom MySQL configuration
      - ./my.cnf:/etc/mysql/conf.d/custom.cnf:ro
    networks:
      - internal
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 60s

  # Optional: phpMyAdmin for database management
  phpmyadmin:
    image: phpmyadmin:latest
    container_name: ${SITE_NAME:-wordpress}_pma
    restart: unless-stopped
    environment:
      PMA_HOST: mariadb
      PMA_PORT: 3306
      UPLOAD_LIMIT: 300M
    networks:
      - internal
      - traefik
    depends_on:
      - mariadb
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      - "traefik.http.routers.${SITE_NAME:-wordpress}-pma.rule=Host(`pma.${DOMAIN}`)"
      - "traefik.http.routers.${SITE_NAME:-wordpress}-pma.entrypoints=websecure"
      - "traefik.http.routers.${SITE_NAME:-wordpress}-pma.tls=true"
      - "traefik.http.routers.${SITE_NAME:-wordpress}-pma.tls.certresolver=letsencrypt"
      - "traefik.http.services.${SITE_NAME:-wordpress}-pma.loadbalancer.server.port=80"
      # Basic auth for security
      - "traefik.http.routers.${SITE_NAME:-wordpress}-pma.middlewares=auth@file"

networks:
  traefik:
    external: true
  internal:
    external: true

volumes:
  db_data:
  wp_content: