docker-compose.yml

# ============================================================================
# IterBot-UTFPR - Docker Compose Configuration
# ============================================================================
#
# ⚠️ IMPORTANTE: Configuração de Credenciais
#
# Este arquivo usa variáveis de ambiente para senhas e chaves API.
# NÃO ARMAZENE SENHAS NO GITHUB!
#
# Para configurar localmente:
# 1. Copie .env.example para .env
# 2. Ou execute: ./scripts/setup-local.sh
# 3. Edite o arquivo .env com suas credenciais
#
# Production-ready configuration with:
# - PostgreSQL for data persistence
# - Redis for caching and sessions
# - Django backend with REST API
# - WAHA for WhatsApp integration
# - Traefik for reverse proxy and HTTPS
# ============================================================================

services:
  # ==========================================================================
  # Traefik - Reverse Proxy & Load Balancer
  # ==========================================================================
  traefik:
    image: traefik:v3.6
    container_name: iterbot_traefik
    restart: unless-stopped
    environment:
      - DOCKER_API_VERSION=1.54
    command:
      - "--configFile=/etc/traefik/traefik.yml"
    ports:
      - "80:80"
      - "443:443"
      # Dashboard (8080) desabilitado por padrao — habilite localmente via
      # docker-compose.override.yml se precisar.
    volumes:
      - ./infra/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./infra/traefik/dynamic:/etc/traefik/dynamic:ro
      - ./secrets/users:/etc/traefik/users:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_certs:/letsencrypt
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - web
    labels:
      - "traefik.enable=false"  # Don't proxy Traefik itself

  # ==========================================================================
  # PostgreSQL - Database
  # ==========================================================================
  db:
    image: postgres:15-alpine
    container_name: iterbot_db
    restart: unless-stopped
    volumes:
      - postgres_data:/var/lib/postgresql/data/
    environment:
      - POSTGRES_DB=${POSTGRES_DB:-iterbot}
      - POSTGRES_USER=${POSTGRES_USER:-iterbot_user}
      - POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
    secrets:
      - postgres_password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-iterbot_user} -d ${POSTGRES_DB:-iterbot}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - web
    labels:
      - "traefik.enable=false"

  # ==========================================================================
  # Redis - Cache & Session Store
  # ==========================================================================
  redis:
    image: redis:7-alpine
    container_name: iterbot_redis
    restart: unless-stopped
    volumes:
      - redis_data:/data
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s
    networks:
      - web
    labels:
      - "traefik.enable=false"

  # ==========================================================================
  # Django Backend - REST API & Business Logic
  # ==========================================================================
  backend:
    build:
      context: .
      dockerfile: docker/django/Dockerfile
    container_name: iterbot_backend
    restart: unless-stopped
    command: /start.sh
    # Sem porta publica: acesso ao backend e somente via Traefik (rede interna).
    # Para debug local, use docker-compose.override.yml expondo 127.0.0.1:8000:8000.
    labels:
      - "traefik.enable=true"
      # HTTP → redireciona para HTTPS
      - "traefik.http.routers.backend.rule=Host(`${DOMAIN:-localhost}`)"
      - "traefik.http.routers.backend.entrypoints=web"
      - "traefik.http.routers.backend.middlewares=redirect-to-https"
      # HTTPS router
      - "traefik.http.routers.backend-secure.rule=Host(`${DOMAIN:-localhost}`)"
      - "traefik.http.routers.backend-secure.entrypoints=websecure"
      - "traefik.http.routers.backend-secure.tls=true"
      - "traefik.http.services.backend.loadbalancer.server.port=8000"
      # Middleware de redirect HTTP→HTTPS
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.permanent=true"
    env_file:
      - .env
    secrets:
      - django_secret_key
      - email_password
      - postgres_password
      - aws_access_key_id
      - aws_secret_access_key
      - brevo_api_key
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - web

  # ==========================================================================
  # WAHA - WhatsApp HTTP API
  # ==========================================================================
  # Em dev, acesso via Traefik (waha.localhost). Em PRODUCAO o override
  # docker-compose.prod.yml desabilita a rota Traefik (traefik.enable=false)
  # e binda a porta 3000 apenas no loopback do host — acesso ao dashboard
  # somente via tunel SSH (ssh -L 3000:localhost:3000).
  # ==========================================================================
  waha:
    image: devlikeapro/waha
    container_name: iterbot_waha
    restart: unless-stopped
    # Usando entrypoint padrão do WAHA
    environment:
      # WhatsApp Engine Configuration
      - WHATSAPP_DEFAULT_ENGINE=NOWEB
      - WHATSAPP_HOOK_URL=http://backend:8000/webhook/
      - WHATSAPP_HOOK_EVENTS=message.any

      # Dashboard Configuration
      - WAHA_DASHBOARD_ENABLED=true
      - WAHA_DASHBOARD_USERNAME=${WAHA_DASHBOARD_USERNAME}
      - WAHA_DASHBOARD_PASSWORD=${WAHA_DASHBOARD_PASSWORD}

      # Swagger Configuration
      - WHATSAPP_SWAGGER_USERNAME=${WHATSAPP_SWAGGER_USERNAME}
      - WHATSAPP_SWAGGER_PASSWORD=${WHATSAPP_SWAGGER_PASSWORD}

      # API Configuration
      - WAHA_API_KEY=${WAHA_API_KEY}

      # Logging
      - WAHA_LOG_LEVEL=info
      - WAHA_LOG_FORMAT=PRETTY
    volumes:
      - waha_sessions:/app/.sessions
    networks:
      - web
    healthcheck:
      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --header=\"X-Api-Key: $WAHA_API_KEY\" -O /dev/null http://localhost:3000/api/version || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    labels:
      - "traefik.enable=true"
      # HTTP router para WAHA dashboard
      - "traefik.http.routers.waha.rule=Host(`waha.${DOMAIN:-localhost}`)"
      - "traefik.http.routers.waha.entrypoints=web"
      - "traefik.http.routers.waha.middlewares=redirect-to-https"
      # HTTPS router para WAHA dashboard
      - "traefik.http.routers.waha-secure.rule=Host(`waha.${DOMAIN:-localhost}`)"
      - "traefik.http.routers.waha-secure.entrypoints=websecure"
      - "traefik.http.routers.waha-secure.tls=true"
      - "traefik.http.services.waha.loadbalancer.server.port=3000"

# ============================================================================
# Docker Secrets - Secure Credential Management
# ============================================================================
secrets:
  django_secret_key:
    file: ./secrets/django_secret_key.txt
  postgres_password:
    file: ./secrets/postgres_password.txt
  waha_api_key:
    file: ./secrets/waha_api_key.txt
  waha_dashboard_password:
    file: ./secrets/waha_dashboard_password.txt
  waha_swagger_password:
    file: ./secrets/waha_swagger_password.txt
  email_password:
    file: ./secrets/email_password.txt
  aws_access_key_id:
    file: ./secrets/aws_access_key_id.txt
  aws_secret_access_key:
    file: ./secrets/aws_secret_access_key.txt
  brevo_api_key:
    file: ./secrets/brevo_api_key.txt

# ============================================================================
# Volumes - Data Persistence
# ============================================================================
volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local
  waha_sessions:
    driver: local
  traefik_certs:
    driver: local

# ============================================================================
# Networks - Service Communication
# ============================================================================
networks:
  web:
    name: web
    driver: bridge
    ipam:
      config:
        - subnet: 172.21.0.0/16