version: '3.8'

# ==============================================================================
# NOVA V2: High-Performance Standalone Rust Inference Pipeline
# Production & Staging Verification Cluster
# ==============================================================================

services:
  # 1. Primary Stable Inference Relay
  nova-relay:
    build:
      context: .
      dockerfile: Dockerfile
    image: nova-relay:latest
    container_name: nova-relay-stable
    restart: unless-stopped
    stop_grace_period: 40s
    init: true
    user: "10001:10001"
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 128
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=16m,uid=10001,gid=10001
    ports:
      # STRICT LOCAL-ONLY BINDING: 127.0.0.1 prevents any external/LAN exposure
      - "127.0.0.1:${NOVA_PORT:-3001}:3001"
    environment:
      - RUST_LOG=info
      - NOVA_HOST=0.0.0.0
      - NOVA_PORT=3001
      - NOVA_SHARD_CONCURRENCY=64
      - NOVA_BUFFER_RETENTION_MS=300000
      - CODEX_WS_ENDPOINT=${CODEX_WS_ENDPOINT:-wss://chatgpt.com/backend-api/codex/responses}
      - CODEX_ACCESS_TOKEN=${CODEX_ACCESS_TOKEN:-}
      - CODEX_ACCOUNT_ID=${CODEX_ACCOUNT_ID:-}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
          pids: 128
        reservations:
          memory: 64M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:3001/health"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s
    networks:
      - nova-net

  # 2. Canary Inference Relay (For testing zero-downtime canary rollouts)
  nova-canary:
    build:
      context: .
      dockerfile: Dockerfile
    image: nova-canary:latest
    container_name: nova-relay-canary
    restart: unless-stopped
    stop_grace_period: 40s
    init: true
    user: "10001:10001"
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 128
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=16m,uid=10001,gid=10001
    ports:
      - "127.0.0.1:3002:3001"
    environment:
      - RUST_LOG=debug
      - NOVA_HOST=0.0.0.0
      - NOVA_PORT=3001
      - NOVA_SHARD_CONCURRENCY=32
      - NOVA_BUFFER_RETENTION_MS=300000
      - CODEX_WS_ENDPOINT=${CODEX_WS_ENDPOINT:-wss://chatgpt.com/backend-api/codex/responses}
      - CODEX_ACCESS_TOKEN=${CODEX_ACCESS_TOKEN:-}
      - CODEX_ACCOUNT_ID=${CODEX_ACCOUNT_ID:-}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
          pids: 128
        reservations:
          memory: 64M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:3001/health"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s
    networks:
      - nova-net

  # 3. NGINX Edge Reverse Proxy (Terminating TLS, SSE unbuffered pass-through)
  nginx-edge:
    image: nginx:alpine
    container_name: nova-nginx-edge
    ports:
      - "3000:80"
    volumes:
      - ./deploy/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - nova-relay
      - nova-canary
    restart: always
    networks:
      - nova-net

  # 4. Prometheus Real-Time Metrics Scraper
  prometheus:
    image: prom/prometheus:v2.54.0
    container_name: nova-prometheus
    ports:
      - "9090:9090"
    volumes:
      - ./deploy/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
    depends_on:
      - nova-relay
    restart: always
    networks:
      - nova-net

networks:
  nova-net:
    driver: bridge