docker-compose.yml

services:
  db:
    image: postgres:15-alpine
    restart: unless-stopped
    env_file: .env
    environment:
      POSTGRES_DB: ${DB_NAME:-surveydb}
      POSTGRES_USER: ${DB_USER:-surveyuser}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-surveyuser} -d ${DB_NAME:-surveydb}"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --maxmemory 128mb --maxmemory-policy allkeys-lru --save ""
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    restart: unless-stopped
    env_file: .env
    environment:
      - DJANGO_SETTINGS_MODULE=config.settings.prod
      - DATABASE_URL=postgres://${DB_USER:-surveyuser}:${DB_PASSWORD}@db:5432/${DB_NAME:-surveydb}
    # Direct port 8000 access bypassed nginx and exposed the API without rate-limiting.
    expose:
      - "8000"
    volumes:
      - media_data:/app/media
      - static_data:/app/staticfiles
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    command: >
      sh -c "python manage.py migrate &&
             python manage.py collectstatic --noinput &&
             python manage.py create_admin_if_not_exists &&
             gunicorn config.wsgi:application --bind 0.0.0.0:8000 --workers 3 --timeout 120"
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import socket; s=socket.socket(); s.connect(('localhost',8000)); s.close()\" 2>/dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 60s

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        - VITE_API_BASE_URL=/api
        - VITE_PUBLIC_BASE_URL=${VITE_PUBLIC_BASE_URL:-}
    restart: unless-stopped
    expose:
      - "3000"
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:3000/"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 20s

  #   - serves as the single public entry point on port 80
  #   - serves /static/ and /media/ from shared volumes
  #   - forwards the real client IP via X-Real-IP (works correctly on Linux)
  nginx:
    image: nginx:alpine
    restart: unless-stopped
    ports:
      - "80:80"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - static_data:/app/staticfiles:ro
      - media_data:/app/media:ro
    depends_on:
      backend:
        condition: service_healthy
      frontend:
        condition: service_healthy

volumes:
  postgres_data:
  redis_data:
  media_data:
  static_data: