# S3-compatible object storage (MinIO) for the platform's document blobs.
#
# Holds the scanned utility bills / IDs / policy docs extracted from the
# Access LONGBINARY columns (migration step 4). MySQL keeps only the pointer
# (storageKey) + metadata; the bytes live here.
#
# Target: Portainer local endpoint on cubex (3-node Swarm). Same statefulness
# rules as the MySQL stack (deploy/jorgecuadros-db.stack.yml): named volume +
# pinned to one node so the data volume is stable. Reuses the same node label.
#
# DEV / PROD as two stacks from this one file:
#   dev : stack jorgecuadros-dev-minio  API 9100 / console 9101
#   prod: stack jorgecuadros-prod-minio API 9000 / console 9001
# Swarm namespaces the volume per stack name -> isolated data per environment.
#
# Secrets (MINIO_ROOT_USER / MINIO_ROOT_PASSWORD) injected via Portainer stack
# env at deploy time, not committed.

version: "3.8"

services:
  minio:
    image: minio/minio:RELEASE.2024-10-13T13-34-11Z
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:?MINIO_ROOT_USER must be set}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD must be set}
    ports:
      - target: 9000
        published: ${MINIO_API_PORT:-9000}
        protocol: tcp
        mode: ingress
      - target: 9001
        published: ${MINIO_CONSOLE_PORT:-9001}
        protocol: tcp
        mode: ingress
    volumes:
      - minio_data:/data
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.jorgecuadros_db == true
      restart_policy:
        condition: any
      update_config:
        order: stop-first
    healthcheck:
      test: ["CMD-SHELL", "mc ready local || curl -f http://localhost:9000/minio/health/live || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s

volumes:
  minio_data: