# Docker Compose - Entorno de produccion
# Incluye: API, WebSocket, Workers, Web, Nginx, Prometheus, Grafana
# Uso: docker compose -f docker-compose.prod.yml up -d
#
# IMPORTANTE: Todos los secrets deben venir de variables de entorno o Docker secrets.
# NUNCA hardcodear credenciales en este archivo.

services:
  # ============================================================
  # Nginx - Reverse proxy + load balancer
  # ============================================================
  nginx:
    image: nginx:alpine
    container_name: chatapp-nginx
    restart: unless-stopped
    depends_on:
      api:
        condition: service_healthy
      realtime:
        condition: service_healthy
      frontend:
        condition: service_healthy
    ports:
      - "80:80"
    volumes:
      - ./nginx/nginx.dev.conf:/etc/nginx/nginx.conf:ro
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
      - /var/cache/nginx
      - /var/run
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: "0.5"

  # ============================================================
  # API Backend (NestJS)
  # ============================================================
  api:
    build:
      context: .
      dockerfile: backend/apps/api/Dockerfile
    container_name: chatapp-api
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: 3010
      API_PORT: 3010
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      REDIS_URL: ${REDIS_URL:?REDIS_URL is required}
      MEILISEARCH_URL: http://meilisearch:7700
      MEILISEARCH_KEY: ${MEILISEARCH_KEY:?MEILISEARCH_KEY is required}
      S3_ENDPOINT: http://minio:9000
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:?S3_ACCESS_KEY is required}
      S3_SECRET_KEY: ${S3_SECRET_KEY:?S3_SECRET_KEY is required}
      S3_BUCKET: chatapp-files
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
      ENCRYPTION_KEY: ${ENCRYPTION_KEY:?ENCRYPTION_KEY is required}
      CORS_ORIGINS: ${CORS_ORIGINS:-https://app.chatapp.com}
    expose:
      - "3010"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3010/api/v1/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"

  # ============================================================
  # WebSocket Server (Socket.io)
  # ============================================================
  realtime:
    build:
      context: .
      dockerfile: backend/apps/realtime/Dockerfile
    container_name: chatapp-realtime
    restart: unless-stopped
    depends_on:
      redis:
        condition: service_healthy
    environment:
      NODE_ENV: production
      PORT: 3002
      WS_PORT: 3002
      REDIS_URL: ${REDIS_URL:?REDIS_URL is required}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
    expose:
      - "3002"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3002/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"

  # ============================================================
  # Workers (Background jobs)
  # ============================================================
  workers:
    build:
      context: .
      dockerfile: backend/apps/workers/Dockerfile
    container_name: chatapp-workers
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      NODE_ENV: production
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      REDIS_URL: ${REDIS_URL:?REDIS_URL is required}
      MEILISEARCH_URL: http://meilisearch:7700
      MEILISEARCH_KEY: ${MEILISEARCH_KEY:?MEILISEARCH_KEY is required}
      S3_ENDPOINT: http://minio:9000
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:?S3_ACCESS_KEY is required}
      S3_SECRET_KEY: ${S3_SECRET_KEY:?S3_SECRET_KEY is required}
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"

  # ============================================================
  # Frontend (Next.js)
  # ============================================================
  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
    container_name: chatapp-frontend
    restart: unless-stopped
    depends_on:
      api:
        condition: service_healthy
    environment:
      NODE_ENV: production
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-https://api.chatapp.com/api/v1}
      NEXT_PUBLIC_WS_URL: ${NEXT_PUBLIC_WS_URL:-wss://api.chatapp.com/ws}
    expose:
      - "3001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"

  # ============================================================
  # PostgreSQL - Base de datos (produccion)
  # ============================================================
  postgres:
    image: pgvector/pgvector:pg16
    container_name: chatapp-postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:?POSTGRES_USER is required}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
      POSTGRES_DB: ${POSTGRES_DB:-chatapp}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./backend/libs/database/init:/docker-entrypoint-initdb.d
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-chatapp}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "1.0"

  # ============================================================
  # Redis (produccion)
  # ============================================================
  redis:
    image: redis:7-alpine
    container_name: chatapp-redis
    restart: unless-stopped
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"

  # ============================================================
  # MinIO (produccion)
  # ============================================================
  minio:
    image: minio/minio:latest
    container_name: chatapp-minio
    restart: unless-stopped
    environment:
      MINIO_ROOT_USER: ${S3_ACCESS_KEY:?S3_ACCESS_KEY is required}
      MINIO_ROOT_PASSWORD: ${S3_SECRET_KEY:?S3_SECRET_KEY is required}
    command: server /data --console-address ":9001"
    volumes:
      - minio_data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true

  # ============================================================
  # Meilisearch (produccion)
  # ============================================================
  meilisearch:
    image: getmeili/meilisearch:v1.12
    container_name: chatapp-meilisearch
    restart: unless-stopped
    environment:
      MEILI_MASTER_KEY: ${MEILISEARCH_KEY:?MEILISEARCH_KEY is required}
      MEILI_ENV: production
    volumes:
      - meili_data:/meili_data
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true

  # ============================================================
  # Prometheus - Metrics collection
  # ============================================================
  prometheus:
    image: prom/prometheus:latest
    container_name: chatapp-prometheus
    restart: unless-stopped
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./monitoring/alerts.yml:/etc/prometheus/rules/alerts.yml:ro
      - prometheus_data:/prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--storage.tsdb.retention.time=30d'
      - '--web.enable-lifecycle'
    expose:
      - "9090"
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.5"

  # ============================================================
  # Grafana - Dashboards
  # ============================================================
  grafana:
    image: grafana/grafana:latest
    container_name: chatapp-grafana
    restart: unless-stopped
    depends_on:
      - prometheus
    environment:
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:?GRAFANA_PASSWORD is required}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_SECURITY_DISABLE_GRAVATAR: "true"
      GF_SECURITY_COOKIE_SECURE: "true"
      GF_SECURITY_STRICT_TRANSPORT_SECURITY: "true"
      GF_SECURITY_X_CONTENT_TYPE_OPTIONS: "true"
      GF_SECURITY_X_XSS_PROTECTION: "true"
    volumes:
      - grafana_data:/var/lib/grafana
    expose:
      - "3000"
    networks:
      - chatapp-prod-net
    security_opt:
      - no-new-privileges:true
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: "0.5"

networks:
  chatapp-prod-net:
    driver: bridge

volumes:
  postgres_data:
  redis_data:
  minio_data:
  meili_data:
  prometheus_data:
  grafana_data: