services:
  # Neo4j Database
  neo4j:
    image: neo4j:latest
    container_name: pwnflow-neo4j-prod
    # Remove external ports - only accessible within network
    volumes:
      - $PWD/neo4j-data-prod:/data
    environment:
      - NEO4J_AUTH=${NEO4J_AUTH:-neo4j/password}
      - NEO4J_PLUGINS=["apoc"]
      - NEO4J_dbms_security_procedures_unrestricted=apoc.*
    restart: unless-stopped
    networks:
      - pwnflow-prod-network
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --no-verbose --tries=1 --spider http://localhost:7474 || exit 1",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  # Redis Cache
  redis:
    image: redis:7-alpine
    container_name: pwnflow-redis-prod
    volumes:
      - redis-data-prod:/data
    restart: unless-stopped
    command: redis-server --appendonly yes
    networks:
      - pwnflow-prod-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s

  # Backend API
  backend:
    build:
      context: .
      dockerfile: backend/Dockerfile.prod
    container_name: pwnflow-backend-prod
    env_file:
      - ./.env.production
    environment:
      - NEO4J_URI=bolt://neo4j:7687
      - NEO4J_USER=neo4j
      - REDIS_URL=redis://redis:6379
      - AI_SERVICE_URL=http://ai-service:8001
      - PYTHONUNBUFFERED=1
      - PYTHONPATH=/app
    depends_on:
      neo4j:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - pwnflow-prod-network
    healthcheck:
      test:
        ["CMD-SHELL", "curl -f http://localhost:8000/api/v1/health || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  # AI Microservice API
  ai-service:
    build:
      context: .
      dockerfile: services/ai-service/Dockerfile
    container_name: pwnflow-ai-service-prod
    expose:
      - "8001"
    environment:
      - REDIS_URL=redis://redis:6379
      - GOOGLE_API_KEY=${GOOGLE_API_KEY}
      - SERVICE_VERSION=${APP_VERSION:-1.0.0}
    depends_on:
      redis:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - pwnflow-prod-network

  # AI Celery Worker
  ai-worker:
    build:
      context: .
      dockerfile: services/ai-service/Dockerfile
    container_name: pwnflow-ai-worker-prod
    environment:
      - REDIS_URL=redis://redis:6379
      - GOOGLE_API_KEY=${GOOGLE_API_KEY}
    depends_on:
      redis:
        condition: service_healthy
      ai-service:
        condition: service_started
    restart: unless-stopped
    networks:
      - pwnflow-prod-network
    command: celery -A celery_app worker --loglevel=warning --concurrency=2

  # Nginx with Frontend
  nginx:
    build:
      context: .
      dockerfile: Dockerfile.nginx
      args:
        - VITE_API_BASE_URL=${FRONTEND_API_URL:-/api/v1}
        - VITE_APP_ENV=${APP_ENV:-production}
        - VITE_ENABLE_ANALYTICS=${ENABLE_ANALYTICS:-true}
    container_name: pwnflow-nginx-prod
    ports:
      - "80:80"
      - "443:443" # For HTTPS in production
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - pwnflow-prod-network
    volumes:
      # For Let's Encrypt certificates
      - ./certbot/conf:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget --no-verbose --tries=1 --spider http://localhost/ || exit 1",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

networks:
  pwnflow-prod-network:
    driver: bridge

volumes:
  neo4j-data-prod:
  redis-data-prod: