# HexaHost GameCloud — production Docker Compose stack
# Usage:
#   docker network create traefik-network
#   cp .env.example .env.prod && edit secrets/domains
#   docker compose -f deploy/compose/compose.prod.yml --env-file .env.prod up -d

name: hexahost-gamecloud-prod

services:
  postgres:
    image: postgres:16-alpine
    restart: always
    env_file:
      - ../../.env.prod
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-gamecloud}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB:-gamecloud}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - gamecloud-internal
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"

  redis:
    image: redis:7-alpine
    restart: always
    command: ["redis-server", "--appendonly", "yes", "--appendfsync", "everysec"]
    env_file:
      - ../../.env.prod
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - gamecloud-internal
    logging:
      driver: json-file
      options:
        max-size: "20m"
        max-file: "3"

  minio:
    image: minio/minio:RELEASE.2024-12-18T13-15-44Z
    restart: always
    command: server /data --console-address ":9001"
    env_file:
      - ../../.env.prod
    environment:
      MINIO_ROOT_USER: ${S3_ACCESS_KEY}
      MINIO_ROOT_PASSWORD: ${S3_SECRET_KEY}
    volumes:
      - minio_data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - gamecloud-internal
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"

  minio-init:
    image: minio/mc:RELEASE.2024-11-05T11-14-20Z
    restart: "no"
    depends_on:
      minio:
        condition: service_healthy
    env_file:
      - ../../.env.prod
    entrypoint: >
      /bin/sh -c "
      mc alias set local http://minio:9000 $${S3_ACCESS_KEY} $${S3_SECRET_KEY};
      mc mb --ignore-existing local/$${S3_BUCKET:-gamecloud};
      mc anonymous set none local/$${S3_BUCKET:-gamecloud};
      exit 0;
      "
    environment:
      S3_ACCESS_KEY: ${S3_ACCESS_KEY}
      S3_SECRET_KEY: ${S3_SECRET_KEY}
      S3_BUCKET: ${S3_BUCKET:-gamecloud}
    networks:
      - gamecloud-internal

  api:
    build:
      context: ../..
      dockerfile: apps/api/Dockerfile
    image: hexahost-gamecloud-api:${GAMECLOUD_IMAGE_TAG:-latest}
    restart: always
    env_file:
      - ../../.env.prod
    environment:
      NODE_ENV: production
      APP_ENV: production
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-gamecloud}
      REDIS_URL: redis://redis:6379
      S3_ENDPOINT: http://minio:9000
      TRUSTED_PROXY_COUNT: ${TRUSTED_PROXY_COUNT:-1}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3001/api/v1/health/live"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 60s
    networks:
      - gamecloud-internal
      - traefik-network
    labels:
      - traefik.enable=true
      - traefik.docker.network=${TRAEFIK_NETWORK:-traefik-network}
      - traefik.http.routers.gamecloud-api.rule=Host(`${API_HOST:-api.example.net}`)
      - traefik.http.routers.gamecloud-api.entrypoints=websecure
      - traefik.http.routers.gamecloud-api.tls=true
      - traefik.http.routers.gamecloud-api.tls.certresolver=letsencrypt
      - traefik.http.routers.gamecloud-api.middlewares=gamecloud-api-headers@file,gamecloud-rate-limit@file
      - traefik.http.routers.gamecloud-api.service=gamecloud-api
      - traefik.http.services.gamecloud-api.loadbalancer.server.port=3001
      - traefik.http.routers.gamecloud-api-http.rule=Host(`${API_HOST:-api.example.net}`)
      - traefik.http.routers.gamecloud-api-http.entrypoints=web
      - traefik.http.routers.gamecloud-api-http.middlewares=gamecloud-redirect-https@file
    logging:
      driver: json-file
      options:
        max-size: "100m"
        max-file: "10"

  worker:
    build:
      context: ../..
      dockerfile: apps/worker/Dockerfile
    image: hexahost-gamecloud-worker:${GAMECLOUD_IMAGE_TAG:-latest}
    restart: always
    env_file:
      - ../../.env.prod
    environment:
      NODE_ENV: production
      APP_ENV: production
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-gamecloud}
      REDIS_URL: redis://redis:6379
      S3_ENDPOINT: http://minio:9000
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3002/health"]
      interval: 20s
      timeout: 5s
      retries: 5
      start_period: 60s
    networks:
      - gamecloud-internal
    logging:
      driver: json-file
      options:
        max-size: "100m"
        max-file: "10"

  web:
    build:
      context: ../..
      dockerfile: apps/web/Dockerfile
    image: hexahost-gamecloud-web:${GAMECLOUD_IMAGE_TAG:-latest}
    restart: always
    env_file:
      - ../../.env.prod
    environment:
      NODE_ENV: production
      API_URL: http://api:3001
    depends_on:
      api:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/de"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 60s
    networks:
      - gamecloud-internal
      - traefik-network
    labels:
      - traefik.enable=true
      - traefik.docker.network=${TRAEFIK_NETWORK:-traefik-network}
      - traefik.http.routers.gamecloud-web.rule=Host(`${WEB_HOST:-panel.example.net}`)
      - traefik.http.routers.gamecloud-web.entrypoints=websecure
      - traefik.http.routers.gamecloud-web.tls=true
      - traefik.http.routers.gamecloud-web.tls.certresolver=letsencrypt
      - traefik.http.routers.gamecloud-web.middlewares=gamecloud-web-headers@file
      - traefik.http.routers.gamecloud-web.service=gamecloud-web
      - traefik.http.services.gamecloud-web.loadbalancer.server.port=3000
      - traefik.http.routers.gamecloud-web-http.rule=Host(`${WEB_HOST:-panel.example.net}`)
      - traefik.http.routers.gamecloud-web-http.entrypoints=web
      - traefik.http.routers.gamecloud-web-http.middlewares=gamecloud-redirect-https@file
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"

volumes:
  postgres_data:
    name: hexahost-gamecloud-postgres
  redis_data:
    name: hexahost-gamecloud-redis
  minio_data:
    name: hexahost-gamecloud-minio

networks:
  gamecloud-internal:
    name: hexahost-gamecloud-internal
    driver: bridge
  traefik-network:
    external: true
    name: ${TRAEFIK_NETWORK:-traefik-network}