x-backend-base: &backend-base
  build:
    context: backend
    target: prod
  env_file:
    - docker.prod.env
    - backend.prod.env
  restart: unless-stopped
  healthcheck:
    test: [ "CMD", "wget", "-q", "--spider", "http://localhost:8000/api/healthz" ]
    interval: 15s
    timeout: 3s
    retries: 10
    start_period: 20s
  volumes:
    # static files for django /admin control panel
    - ./backend/static:/backend/static
  networks:
    - decompme

x-frontend-base: &frontend-base
  build:
    context: frontend
    target: prod
  env_file:
    - docker.prod.env
  restart: unless-stopped
  healthcheck:
    test: [ "CMD", "wget", "-q", "--spider", "http://localhost:8080/healthz" ]
    interval: 15s
    timeout: 3s
    retries: 10
    start_period: 20s
  networks:
    - decompme

x-cromper-base: &cromper-base
  build:
    context: cromper
    target: prod
  cap_drop:
    - all
  cap_add:
    - setuid
    - setgid
    - setfcap
  devices:
    - /dev/kvm:/dev/kvm
  env_file:
    - docker.prod.env
    - cromper.prod.env
  restart: unless-stopped
  security_opt:
    - apparmor=unconfined
    - seccomp=unconfined
  volumes:
    - ./cromper/compilers:/cromper/compilers:ro
    - ./cromper/libraries:/cromper/libraries:ro
  tmpfs:
    - /sandbox/tmp:exec,uid=1000,gid=1000,size=256M,mode=0700
  healthcheck:
    test: [ "CMD", "curl", "-f", "http://localhost:8888/healthz" ]
    interval: 15s
    timeout: 3s
    retries: 10
    start_period: 10s
  networks:
    - decompme

services:
  cromper-orange:
    <<: *cromper-base
    image: ghcr.io/decompme/decompme-cromper:${CROMPER_ORANGE_TAG:-latest}

  cromper-purple:
    <<: *cromper-base
    image: ghcr.io/decompme/decompme-cromper:${CROMPER_PURPLE_TAG:-latest}

  cromper-proxy:
    image: ghcr.io/decompme/decompme-cromper-proxy:${CROMPER_PROXY_TAG:-latest}
    build:
      context: cromper-proxy
    healthcheck:
      test: [ "CMD", "wget", "-q", "--spider", "http://127.0.0.1:8888/healthz" ]
      interval: 15s
      timeout: 3s
      retries: 10
      start_period: 5s
    restart: unless-stopped
    volumes:
      - ./cromper-proxy/production/runtime:/etc/nginx/conf.d/runtime:ro
    networks:
      - decompme

  backend-blue:
    <<: *backend-base
    image: ghcr.io/decompme/decompme-backend:${BLUE_TAG:-latest}
    environment:
      CROMPER_URL: http://cromper-proxy:8888

  frontend-blue:
    <<: *frontend-base
    image: ghcr.io/decompme/decompme-frontend:${BLUE_TAG:-latest}
    environment:
      INTERNAL_API_BASE: http://backend-blue:8000/api
      INTERNAL_CROMPER_BASE: http://cromper-proxy:8888

  backend-green:
    <<: *backend-base
    image: ghcr.io/decompme/decompme-backend:${GREEN_TAG:-latest}
    environment:
      CROMPER_URL: http://cromper-proxy:8888

  frontend-green:
    <<: *frontend-base
    image: ghcr.io/decompme/decompme-frontend:${GREEN_TAG:-latest}
    environment:
      INTERNAL_API_BASE: http://backend-green:8000/api
      INTERNAL_CROMPER_BASE: http://cromper-proxy:8888

  nginx:
    image: ghcr.io/decompme/decompme-nginx:${NGINX_TAG:-latest}
    build:
      context: nginx
    healthcheck:
      test: [ "CMD", "wget", "-q", "--spider", "http://127.0.0.1/nginx-healthz" ]
      interval: 15s
      timeout: 3s
      retries: 10
      start_period: 5s
    ports:
      - "80:80"
      - "443:443"
    restart: unless-stopped
    volumes:
      # repo files
      - ./nginx/production/:/etc/nginx/conf.d/:ro
      - ./frontend/down.html:/var/www/decomp.me/down.html:ro
      # certbot
      - ./certbot:/var/www/certbot
      - ./letsencrypt:/etc/letsencrypt
      # static files for django /admin control panel
      - ./backend/static:/var/www/decomp.me/static
      # TODO: mount static + public files from frontend
      # BOOTSTRAP: allow nginx to start before backend/frontend containers are up
      #extra_hosts:
      #  - "backend-blue=172.17.0.1"   # docker0 bridge
      #  - "frontend-blue=172.17.0.1"  # docker0 bridge
    networks:
      - decompme

  certbot:
    image: certbot/certbot
    restart: unless-stopped
    volumes:
      - ./certbot:/var/www/certbot
      - ./letsencrypt:/etc/letsencrypt
    entrypoint: "/bin/sh -c"
    command: >
      "trap exit TERM; while :; do sleep 12h & wait $${!}; certbot renew --webroot -w /var/www/certbot; done"
    networks:
      - decompme

  postgres:
    image: postgres:17
    env_file:
      - docker.prod.env
    restart: unless-stopped
    volumes:
      - ./postgres:/var/lib/postgresql/data
      # BOOTSTRAP: for dumping/restoring db
      - ./pgdump:/pgdump
    networks:
      - decompme
    command: >
      postgres
       -c shared_buffers=8GB
       -c work_mem=128MB
       -c maintenance_work_mem=2GB
       -c effective_cache_size=16GB
       -c wal_buffers=32MB
       -c checkpoint_completion_target=0.9
       -c random_page_cost=1.1
       -c effective_io_concurrency=300

networks:
  decompme:
    driver: bridge