export function generateDockerCompose(): string {
  return `version: "3.8"

services:
  auth-api:
    image: \${REG}/library/auth-yes-api:latest
    env_file: stack.env
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik-net"
      - "traefik.http.routers.auth-api.rule=Host(\`\${SYSTEM_DOMAIN}\`)"
      - "traefik.http.routers.auth-api.entrypoints=websecure"
      - "traefik.http.routers.auth-api.tls=true"
      - "traefik.http.services.auth-api.loadbalancer.server.port=8000"
      - "traefik.http.middlewares.auth-forward.forwardauth.address=http://auth-api:8000/api/forward-auth"
      - "traefik.http.middlewares.auth-forward.forwardauth.trustForwardHeader=true"
      - "traefik.http.middlewares.auth-forward.forwardauth.authResponseHeaders=X-Forwarded-User-Id,X-Forwarded-User,X-Forwarded-Scopes,X-Forwarded-App-Id"
    expose:
      - "8000"
    depends_on:
      - auth-db
      - auth-valkey
    networks:
      - default
      - traefik-net
    volumes:
      - spire-socket:/var/run/spire:ro

  auth-db:
    image: acr.atyg.org/library/postgres:18-alpine
    environment:
      - POSTGRES_USER=\${POSTGRES_USER}
      - POSTGRES_PASSWORD=\${POSTGRES_PASSWORD}
      - POSTGRES_DB=\${POSTGRES_DB}
    volumes:
      - auth-db-data:/var/lib/postgresql
    networks:
      - default

  auth-valkey:
    image: acr.atyg.org/valkey/valkey:8-alpine
    networks:
      - default

volumes:
  auth-db-data:
    driver: local
    driver_opts:
      type: none
      device: \${DB_DATA_PATH}
      o: bind
  spire-socket:
    name: spire-socket

networks:
  default:
    name: auth-internal-net
  traefik-net:
    external: true
`;
}

export function generateSpireDockerCompose(): string {
  return `version: "3.8"

services:
  spire-server:
    image: \${REG}/library/spire-server:latest
    container_name: spire-server
    hostname: spire-server
    networks:
      - auth-internal-net
    volumes:
      - spire-data:/opt/spire

  spire-agent:
    image: \${REG}/library/spire-agent:latest
    container_name: spire-agent
    hostname: spire-agent
    pid: host
    depends_on:
      - spire-server
    networks:
      - auth-internal-net
    volumes:
      - spire-data:/opt/spire
      - spire-socket:/var/run/spire
      - /var/run/docker.sock:/var/run/docker.sock:ro

volumes:
  spire-data:
    driver: local
    driver_opts:
      type: none
      device: \${SPIRE_DATA_PATH}
      o: bind
  spire-socket:
    name: spire-socket

networks:
  auth-internal-net:
    external: true
`;
}