compose.prod.yml

# Defined once so the database, the migration one-shot and the app cannot
# drift apart: alembic hardcodes no database name, and a POSTGRES_DB set on
# only one of them would migrate a different database than the app reads.
x-postgres-env: &postgres_env
  POSTGRES_SERVER: db_pg
  POSTGRES_USER: ${POSTGRES_USER:-postgres}
  POSTGRES_DB: ${POSTGRES_DB:-postgres}
  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}

services:
  db_pg:
    image: postgres:15-alpine
    ports:
      - 5432:5432
    environment:
      <<: *postgres_env
    labels:
      ofelia.enabled: "true"
      # Run the job at 4h37 every day to minimize db load
      ofelia.job-exec.cleanup_logins.schedule: "0 37 4 * * *"
      ofelia.job-exec.cleanup_logins.command: "psql -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-postgres} -f /scripts/cleanup-logins.sql"
    volumes:
      - ./scripts/:/scripts/:ro
      # - ./api-nei/app/db/setup.sql:/docker-entrypoint-initdb.d/nei-0001.sql
      - pg_data:/var/lib/postgresql/data
    healthcheck:
      test: [ "CMD", "pg_isready", "-U", "${POSTGRES_USER:-postgres}", "-d", "${POSTGRES_DB:-postgres}" ]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend
      - nei-shared
    restart: always

  db_mongo:
    image: mongo:6.0.27-jammy
    ports:
      - 27017:27017
    environment:
      MONGO_INITDB_DATABASE: mongo
      MONGO_INITDB_ROOT_USERNAME: mongo
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD}

    volumes:
      - mongo_data:/data/db
    healthcheck:
      test: echo 'db.runCommand("ping").ok' | mongosh --quiet
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 40s
    networks:
      - backend
    restart: always

  # One-shot: applies the api-nei Alembic chain (`nei.*` schema owner) before
  # api_nei starts. Infrastructure's Directus deploy runs AFTER this and only
  # verifies the schema; it never migrates it.
  api_nei_migrate:
    image: ghcr.io/nei-aauav/api-nei:${TAG:-latest}
    build:
      context: api-nei
      dockerfile: Dockerfile.prod
    command: ["python", "-m", "alembic", "upgrade", "head"]
    working_dir: /api_nei
    environment:
      <<: *postgres_env
      ENV: production
    depends_on:
      db_pg:
        condition: service_healthy
    networks:
      - backend
    restart: "no"

  api_nei:
    image: ghcr.io/nei-aauav/api-nei:${TAG:-latest}
    build:
      context: api-nei
      dockerfile: Dockerfile.prod
    ports:
      - 8000:8000
      - 587:587
    environment:
      <<: *postgres_env
      ENV: production
      RECAPTCHA_ENABLED: "True"
      EMAIL_ENABLED: "True"
      JWT_SECRET_KEY_PATH: /jwt.key
      JWT_PUBLIC_KEY_PATH: /jwt.key.pub
      EMAIL_SENDER_ADDRESS: ${EMAIL_SENDER_ADDRESS}
      ENABLED_EXTENSIONS: ${ENABLED_EXTENSIONS:-}
      GIT_COMMIT: ${GIT_COMMIT:-}
      EMAIL_SMTP_HOST: ${EMAIL_SMTP_HOST}
      EMAIL_SMTP_PASSWORD: ${EMAIL_SMTP_PASSWORD}
      EMAIL_SMTP_USER: ${EMAIL_SMTP_USER}
      OIDC_ENABLED: ${OIDC_ENABLED:-false}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
      AUTHENTIK_URL: ${AUTHENTIK_URL:-https://nei.web.ua.pt/authentik}
      AUTHENTIK_TOKEN: ${AUTHENTIK_TOKEN}
      # Must match Infrastructure's DIRECTUS_PUBLIC_URL: api-nei builds
      # every CMS asset URL from it.
      DIRECTUS_PUBLIC_URL: ${DIRECTUS_PUBLIC_URL:-https://nei.web.ua.pt/cms/}
      # Public base of the R2 bucket incl. Directus's storage root (e.g.
      # https://cdn.example.com/cms). Empty keeps every asset on the Directus
      # proxy; set it to serve R2-stored files directly.
      RECAPTCHA_SECRET_KEY: ${RECAPTCHA_SECRET_KEY}
    volumes:
      - /deploy/api-nei/static:/api_nei/static
      - /deploy/keys/jwt.key:/jwt.key:ro
      - /deploy/keys/jwt.key.pub:/jwt.key.pub:ro
      - ./extensions:/extensions:ro
    depends_on:
      db_pg:
        condition: service_healthy
      api_nei_migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/docs').read()"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - backend
    restart: always

  # api_tacaua:
  #   image: ghcr.io/nei-aauav/api-tacaua:${TAG:-latest}
  #   build:
  #     context: api-tacaua
  #     dockerfile: Dockerfile.prod
  #   ports:
  #     - 8001:8001
  #   environment:
  #     ENV: production
  #     API_NEI_SERVER: api_nei
  #     POSTGRES_SERVER: db_pg
  #     POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
  #     PUBLIC_KEY: /jwt.key.pub
  #   volumes: 
  #     - /deploy/api-tacaua/static:/api_tacaua/static
  #     - /deploy/keys/jwt.key.pub:/jwt.key.pub:ro
  #   depends_on:
  #     db_pg:
  #       condition: service_healthy
  #   networks:
  #     - backend
  #   restart: always
  #   profiles:
  #     - disabled

  api_family:
    image: ghcr.io/nei-aauav/api-family:${TAG:-latest}
    build:
      context: api-family
      dockerfile: Dockerfile.prod
    ports:
      - 8002:8002
    environment:
      MONGO_SERVER: db_mongo
      MONGO_USER: mongo
      MONGO_PASSWORD: ${MONGO_PASSWORD}
      MONGO_DB: ${MONGO_DB:-family}
      MONGO_AUTH_SOURCE: admin
      PUBLIC_KEY: /jwt.key.pub
      R2_ENDPOINT_URL: ${R2_ENDPOINT_URL}
      R2_ACCESS_KEY_ID: ${R2_ACCESS_KEY_ID}
      R2_SECRET_ACCESS_KEY: ${R2_SECRET_ACCESS_KEY}
      R2_BUCKET: ${R2_BUCKET}
      R2_PUBLIC_BASE_URL: ${R2_PUBLIC_BASE_URL}
    volumes:
      - ./data_import:/data/import:ro
      - /deploy/keys/jwt.key.pub:/jwt.key.pub:ro
    depends_on:
      db_mongo:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8002/docs').read()"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - backend
    restart: always

  web_nei:
    image: ghcr.io/nei-aauav/web-nei:${TAG:-latest}
    build:
      context: web-nei
      dockerfile: Dockerfile.prod
      args:
        ENABLE_RALLY: ${ENABLE_RALLY:-False}
        RALLY_URL: ${RALLY_URL:-}
        ENABLE_GAMIFICATION: ${ENABLE_GAMIFICATION:-False}
        GAMIFICATION_URL: ${GAMIFICATION_URL:-}
        GOOGLE_CALENDAR_API_KEY: ${GOOGLE_CALENDAR_API_KEY:-}
    ports:
      - 3000:3000
    networks:
      - frontend
    restart: always

  ofelia:
    image: mcuadros/ofelia:latest
    depends_on:
      - db_pg
    command: daemon --docker
    volumes:
      - ${DOCKER_SOCK:-/var/run/docker.sock}:/var/run/docker.sock:ro
    networks:
      - backend
    restart: always

networks:
  backend:
    driver: bridge
  frontend:
    driver: bridge
  # Shared with the Directus service in the Infrastructure repository so it
  # can reach db_pg without exposing Postgres's container port to that stack.
  # Created by the deploy workflow if missing.
  nei-shared:
    external: true

volumes:
  pg_data:
    driver: local
  mongo_data:
    driver: local