# Production stack — pull backend/frontend from Gitea (or Docker Hub fallback).
# HTTPS via Let's Encrypt (certbot) on this host only (nudentic.ir).
#
# Gitea tag deploy: set REGISTRY_PREFIX=wixur.ir:3000/<owner> and TAG=v1.0.1 in .env
# Hub fallback: omit REGISTRY_PREFIX, set DOCKER_USERNAME=dyolink (image dyolink/dyolink-*).
#
# First SSL: ./scripts/init-letsencrypt.sh then up -d
# Tag updates: CI runs scripts/prod-remote-deploy.sh (or pull + up locally)

name: dyolink-prod

services:
  postgres:
    image: postgres:15-alpine
    container_name: dyolink_db_prod
    env_file:
      - ${DEPLOY_SECRETS_DIR:-./secrets}/database.env
    environment:
      TZ: UTC
    volumes:
      - postgres_data_prod:/var/lib/postgresql/data
      - ./database/init.sql:/docker-entrypoint-initdb.d/init.sql:ro
      - ./database/backups:/backups
    networks:
      - dyolink_network
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  backend:
    image: ${REGISTRY_PREFIX:-dyolink}/dyolink-backend:${TAG:-latest}
    container_name: dyolink_backend_prod
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - ${DEPLOY_SECRETS_DIR:-./secrets}/backend.env
    environment:
      NODE_ENV: production
      TZ: UTC
      PORT: "3000"
      SENTRY_ENVIRONMENT: production
      SENTRY_RELEASE: ${TAG:-latest}
    expose:
      - "3000"
    networks:
      - dyolink_network
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/api/health', (r) => {if(r.statusCode!==200)process.exit(1)})"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  frontend:
    image: ${REGISTRY_PREFIX:-dyolink}/dyolink-frontend:${TAG:-latest}
    container_name: dyolink_frontend_prod
    depends_on:
      - backend
    environment:
      NODE_ENV: production
      TZ: UTC
      PORT: "3000"
      HOSTNAME: "0.0.0.0"
    expose:
      - "3000"
    networks:
      - dyolink_network
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      # Next.js `/` redirects to `/en` — accept 2xx/3xx.
      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3000/', (r) => { process.exit(r.statusCode >= 200 && r.statusCode < 400 ? 0 : 1); }).on('error', () => process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  nginx:
    image: nginx:alpine
    container_name: dyolink_nginx_prod
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/generated/default.conf:/etc/nginx/conf.d/default.conf:ro
      - certbot_conf:/etc/letsencrypt:ro
      - certbot_www:/var/www/certbot:ro
      - ./logs/nginx:/var/log/nginx
    networks:
      - dyolink_network
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  certbot:
    image: certbot/certbot:latest
    container_name: dyolink_certbot_prod
    volumes:
      - certbot_conf:/etc/letsencrypt
      - certbot_www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
    networks:
      - dyolink_network
    restart: unless-stopped

networks:
  dyolink_network:
    name: dyolink_network

volumes:
  postgres_data_prod:
    name: dyolink_postgres_data_prod
  certbot_conf:
    name: dyolink_certbot_conf
  certbot_www:
    name: dyolink_certbot_www