services:

  traefik:
    image: traefik:v3.6.6
    command:
      # Compose provider configuration
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"

      # EntryPoints for HTTP and HTTPS
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"

      # Redirect HTTP to HTTPS
      #- "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      #- "--entrypoints.web.http.redirections.entryPoint.scheme=https"

      - "--providers.docker.constraints=Label(`pub_port`,`80`)"
      - "traefik.http.routers.backend.rule=PathPrefix(`/api`)"
      - "traefik.http.routers.backend.middlewares=strip-api"
      - "traefik.http.middlewares.strip-api.replacepathregex.regex=^/api/(.*)"
      - "traefik.http.middlewares.strip-api.replacepathregex.replacement=/$$1"
      - "--providers.file.filename=/etc/traefik/dynamic.yml"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./traefik-dynamic.yml:/etc/traefik/dynamic.yml:ro"
      - "./volumes/certs:/certs:ro"

  frontend:
    image: invincible-voice-frontend:latest
    build:
      context: services/frontend/
      dockerfile: hot-reloading.Dockerfile
    volumes:
      - ./services/frontend/src:/app/src
    environment:
      - NEXT_PUBLIC_GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
    labels:
      - "traefik.enable=true"
      - "pub_port=80"
      - "traefik.http.routers.frontend.rule=PathPrefix(`/`)"
      - "traefik.http.routers.frontend.entrypoints=web"
      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
      - "traefik.http.routers.frontend.priority=10" # lowest priority
      - "traefik.http.routers.frontend-secure.rule=PathPrefix(`/`)"
      - "traefik.http.routers.frontend-secure.entrypoints=websecure"
      - "traefik.http.routers.frontend-secure.tls=true"
      - "traefik.http.routers.frontend-secure.priority=10"

  backend:
    image: invincible-voice-backend:latest
    platform: linux/amd64
    build:
      context: services/backend
      target: hot-reloading
    volumes:
      - ./services/backend/backend:/app/backend
      - ./volumes/users_data:/users_data
    environment:
      - REDIS_HOST=redis
      - REDIS_PORT=6379
      - TTS_LOCK_TTL_SECONDS=300
      - STT_LOCK_TTL_SECONDS=600
      - KYUTAI_LLM_URL=${KYUTAI_LLM_URL}
      - KYUTAI_LLM_API_KEY=${KYUTAI_LLM_API_KEY}
      - KYUTAI_LLM_MODEL=${KYUTAI_LLM_MODEL}
      - KYUTAI_USERS_DATA_PATH=/users_data
      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - GRADIUM_API_KEY=${GRADIUM_API_KEY}
      - TTS_VOICE_ID=${TTS_VOICE_ID}
      - STT_IS_GRADIUM=${STT_IS_GRADIUM}
      - KYUTAI_STT_URL=${KYUTAI_STT_URL}
      - TTS_IS_GRADIUM=${TTS_IS_GRADIUM}
      - TTS_SERVER=${TTS_SERVER}
      - KYUTAI_API_KEY=${KYUTAI_API_KEY}
      - ALLOW_PASSWORD=${ALLOW_PASSWORD}
    labels:
      - "traefik.enable=true"
      - "pub_port=80"
      - "traefik.http.routers.backend.rule=PathPrefix(`/api`)"
      - "traefik.http.routers.backend.middlewares=strip-api"
      - "traefik.http.middlewares.strip-api.replacepathregex.regex=^/api/(.*)"
      - "traefik.http.middlewares.strip-api.replacepathregex.replacement=/$$1"
      - "traefik.http.routers.backend.entrypoints=web"
      - "traefik.http.services.backend.loadbalancer.server.port=80"
      - "traefik.http.routers.backend.priority=100" # higher priority than frontend
      - "traefik.http.routers.backend-secure.rule=PathPrefix(`/api`)"
      - "traefik.http.routers.backend-secure.entrypoints=websecure"
      - "traefik.http.routers.backend-secure.tls=true"
      - "traefik.http.routers.backend-secure.middlewares=strip-api"
      - "traefik.http.routers.backend-secure.priority=100"
      - "traefik.http.routers.block-metrics.rule=Path(`/api/metrics`)"
      - "traefik.http.routers.block-metrics.priority=300"
      - "traefik.http.routers.block-metrics.service=noop@internal"
      - "traefik.http.routers.block-metrics.entrypoints=web"

  redis:
    image: redis:8-alpine
    ports:
      - "6379:6379"
    labels:
      - "traefik.enable=false"

  prometheus:
    image: invincible-voice-prometheus:latest
    build:
      context: services/prometheus
      args:
        CONFIG_FILE: prometheus-local.yml
    volumes:
      - ./volumes/prometheus-data:/prometheus
    labels:
      - "traefik.enable=false"

  grafana:
    image: invincible-voice-grafana:latest
    build:
      context: services/grafana
    volumes:
      - ./volumes/grafana-data:/var/lib/grafana
    environment:
      - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-kyutai}
      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-kyutai-password}
      - GF_INSTALL_PLUGINS=
      - GF_SERVER_ROOT_URL=/grafana
    labels:
      - "traefik.enable=true"
      - "pub_port=80"
      - "traefik.http.routers.grafana.rule=PathPrefix(`/grafana`)"
      - "traefik.http.routers.grafana.entrypoints=web"
      - "traefik.http.routers.grafana.middlewares=grafana-strip"
      - "traefik.http.middlewares.grafana-strip.stripprefix.prefixes=/grafana"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"

networks:
  default: