services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "127.0.0.1:${APP_PORT:-3000}:3000"
    environment:
      - NODE_ENV=production
      - HOST=0.0.0.0
      - PORT=3000
      - DATABASE_URL=postgresql://${POSTGRES_USER:-incudal}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-incudal}
      - REDIS_URL=redis://:${REDIS_PASSWORD:-}@redis:6379
      - JWT_SECRET=${JWT_SECRET}
      - COOKIE_SECRET=${COOKIE_SECRET:-}
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - FRONTEND_URL=${FRONTEND_URL:-}
      - SITE_URL=${SITE_URL:-}
      - LOG_LEVEL=${LOG_LEVEL:-info}
      - DISABLE_REQUEST_LOG=${DISABLE_REQUEST_LOG:-true}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-}
      - ALERT_WEBHOOK_URL=${ALERT_WEBHOOK_URL:-}
      - DB_POOL_MAX=${DB_POOL_MAX:-20}
      - DB_POOL_MIN=${DB_POOL_MIN:-5}
      - DB_CONNECTION_TIMEOUT=${DB_CONNECTION_TIMEOUT:-5000}
      - DB_IDLE_TIMEOUT=${DB_IDLE_TIMEOUT:-30000}
      - DB_STATEMENT_TIMEOUT=${DB_STATEMENT_TIMEOUT:-30000}
      - DB_QUERY_TIMEOUT=${DB_QUERY_TIMEOUT:-30000}
      - TRAFFIC_CONCURRENCY_PER_HOST=${TRAFFIC_CONCURRENCY_PER_HOST:-10}
      - TRAFFIC_HOST_CONCURRENCY=${TRAFFIC_HOST_CONCURRENCY:-3}
      - DB_WORKER_BACKOFF_MS=${DB_WORKER_BACKOFF_MS:-15000}
    volumes:
      - ./server/certs:/app/server/certs:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    restart: unless-stopped

  db:
    image: postgres:16-alpine
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-incudal}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB:-incudal}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-incudal}"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    command: redis-server --requirepass ${REDIS_PASSWORD:-}
    volumes:
      - redis_data:/data
    restart: unless-stopped

volumes:
  postgres_data:
  redis_data:

networks:
  default:
    driver: bridge
    enable_ipv6: true
    ipam:
      config:
        - subnet: "172.31.0.0/16"
        - subnet: "fd42:dead:beef:10::/64"