docker-compose.prod.yml

x-production-build: &production-build
  image: jobhunter-prod:${JOBHUNTER_IMAGE_TAG:?JOBHUNTER_IMAGE_TAG is required; use deploy/prod-compose.sh}
  build:
    context: .
    dockerfile: Dockerfile
    args:
      APP_REVISION: ${JOBHUNTER_IMAGE_TAG:?JOBHUNTER_IMAGE_TAG is required; use deploy/prod-compose.sh}
      APP_BUILD_FLAVOR: production
      INSTALL_PLAYWRIGHT: "0"

x-production-app: &production-app
  <<: *production-build
  environment: &production-environment
    ENVIRONMENT: production
    DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required in production}
    JOBHUNTER_RUNTIME_PREFLIGHT: "1"
    EXPECTED_BUILD_FLAVOR: production
    EXPECTED_APP_REVISION: ${JOBHUNTER_IMAGE_TAG:?JOBHUNTER_IMAGE_TAG is required; use deploy/prod-compose.sh}
    EXPECTED_DATABASE_ROLE: jobhunter_app
    REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD is required in production}@redis:6379/0
    PUBLIC_BASE_URL: ${PUBLIC_BASE_URL:?PUBLIC_BASE_URL is required in production}
    SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required in production}
    ADMIN_PASSWORD_HASH: ${ADMIN_PASSWORD_HASH:?ADMIN_PASSWORD_HASH is required in production}
    TOKEN_ENCRYPTION_KEY: ${TOKEN_ENCRYPTION_KEY:-}
    MCP_API_KEYS_HASHED: ${MCP_API_KEYS_HASHED:-[]}
    REAL_EMAIL_DELIVERY_ENABLED: ${REAL_EMAIL_DELIVERY_ENABLED:-false}
    EMERGENCY_EMAIL_KILL_SWITCH: ${EMERGENCY_EMAIL_KILL_SWITCH:-false}
    EMAIL_PROVIDER: ${EMAIL_PROVIDER:-fake}
    GMAIL_CLIENT_ID: ${GMAIL_CLIENT_ID:-}
    GMAIL_CLIENT_SECRET: ${GMAIL_CLIENT_SECRET:-}
    GOOGLE_ADMIN_EMAILS: ${GOOGLE_ADMIN_EMAILS:-[]}
    USER_ACCOUNTS_ENABLED: ${USER_ACCOUNTS_ENABLED:-false}
    INVITE_REGISTRATION_ENABLED: ${INVITE_REGISTRATION_ENABLED:-false}
    OPENAI_API_KEY: ${OPENAI_API_KEY:-}
    OPENAI_MODEL: ${OPENAI_MODEL:-}
    GEMINI_API_KEY: ${GEMINI_API_KEY:-}
    LLM_PROVIDER: ${LLM_PROVIDER:-mock}
    LLMROUTER_BASE_URL: ${LLMROUTER_BASE_URL:-http://llmrouter:4000}
    LLMROUTER_API_KEY: ${LLMROUTER_API_KEY:-}
    LLMROUTER_PREFER: ${LLMROUTER_PREFER:-quality}
    RESUME_STORAGE_PATH: /data/resumes
    PHONE_EVIDENCE_DIR: /data/phone_evidence
    PHONEGATE_URL: ${PHONEGATE_URL:-}
    PHONEGATE_AUTH_TOKEN: ${PHONEGATE_AUTH_TOKEN:-}
    PHONE_AGENT_ENABLED: ${PHONE_AGENT_ENABLED:-false}
    PHONE_AUTO_ANSWER_ENABLED: ${PHONE_AUTO_ANSWER_ENABLED:-false}
    PHONE_SUMMARY_LLM_ENABLED: ${PHONE_SUMMARY_LLM_ENABLED:-false}
    PHONE_SUMMARY_LLM_BASE_URL: ${PHONE_SUMMARY_LLM_BASE_URL:-}
    PHONE_SUMMARY_LLM_API_KEY: ${PHONE_SUMMARY_LLM_API_KEY:-}
    PHONE_SUMMARY_LLM_MODEL: ${PHONE_SUMMARY_LLM_MODEL:-}
    PHONE_SUMMARY_LLM_PREFER: ${PHONE_SUMMARY_LLM_PREFER:-quality}
    PHONE_VERIFICATION_EXTRACTOR_MODEL: ${PHONE_VERIFICATION_EXTRACTOR_MODEL:-}
    PHONE_VERIFICATION_VERIFIER_MODEL: ${PHONE_VERIFICATION_VERIFIER_MODEL:-}
    PHONE_VERIFICATION_ARBITER_MODEL: ${PHONE_VERIFICATION_ARBITER_MODEL:-}
    PHONE_VERIFICATION_SMS_MODEL: ${PHONE_VERIFICATION_SMS_MODEL:-}
    TELEGRAM_ENABLED: ${TELEGRAM_ENABLED:-false}
    TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
    TELEGRAM_CHAT_ID: ${TELEGRAM_CHAT_ID:-}
    RABOTA_BROWSER_FALLBACK_MODE: none
    RABOTA_PROXY_POOL_ENABLED: ${RABOTA_PROXY_POOL_ENABLED:-false}
    RABOTA_PROXY_PRIMARY_URL: ${RABOTA_PROXY_PRIMARY_URL:-}
    RABOTA_PROXY_FREE_FALLBACK_ENABLED: ${RABOTA_PROXY_FREE_FALLBACK_ENABLED:-true}
    RABOTA_PROXY_DISCOVERY_BATCH: ${RABOTA_PROXY_DISCOVERY_BATCH:-240}
    RABOTA_PROXY_VALIDATION_CONCURRENCY: ${RABOTA_PROXY_VALIDATION_CONCURRENCY:-24}
    RABOTA_PROXY_VALIDATION_TIMEOUT_SECONDS: ${RABOTA_PROXY_VALIDATION_TIMEOUT_SECONDS:-8}
    RABOTA_PROXY_CANDIDATE_TTL_SECONDS: ${RABOTA_PROXY_CANDIDATE_TTL_SECONDS:-1800}
    RABOTA_PROXY_READY_TTL_SECONDS: ${RABOTA_PROXY_READY_TTL_SECONDS:-1800}
    RABOTA_PROXY_REVALIDATION_GRACE_SECONDS: ${RABOTA_PROXY_REVALIDATION_GRACE_SECONDS:-3600}
    RABOTA_PROXY_REVALIDATION_RETRY_SECONDS: ${RABOTA_PROXY_REVALIDATION_RETRY_SECONDS:-300}
    RABOTA_PROXY_REVALIDATION_MAX_FAILURES: ${RABOTA_PROXY_REVALIDATION_MAX_FAILURES:-3}
    RABOTA_PROXY_MAINTENANCE_INTERVAL_SECONDS: ${RABOTA_PROXY_MAINTENANCE_INTERVAL_SECONDS:-900}
    RABOTA_PROXY_MIN_FRESH_FREE: ${RABOTA_PROXY_MIN_FRESH_FREE:-3}
    RABOTA_PROXY_TARGET_READY_FREE: ${RABOTA_PROXY_TARGET_READY_FREE:-3}
    RABOTA_PROXY_PROMOTION_CONCURRENCY: ${RABOTA_PROXY_PROMOTION_CONCURRENCY:-3}
    RABOTA_PROXY_MAX_PREFLIGHT_ATTEMPTS: ${RABOTA_PROXY_MAX_PREFLIGHT_ATTEMPTS:-12}
    RABOTA_PROXY_MAINTENANCE_MAX_PREFLIGHT_ATTEMPTS: ${RABOTA_PROXY_MAINTENANCE_MAX_PREFLIGHT_ATTEMPTS:-9}
    RABOTA_PROXY_BAN_COOLDOWN_SECONDS: ${RABOTA_PROXY_BAN_COOLDOWN_SECONDS:-21600}
    RABOTA_PROXY_DEAD_COOLDOWN_SECONDS: ${RABOTA_PROXY_DEAD_COOLDOWN_SECONDS:-3600}
    RABOTA_PROXY_PRIMARY_DEAD_COOLDOWN_SECONDS: ${RABOTA_PROXY_PRIMARY_DEAD_COOLDOWN_SECONDS:-300}
    RABOTA_PROXY_MAX_FAILOVERS: ${RABOTA_PROXY_MAX_FAILOVERS:-4}
    LOG_LEVEL: ${LOG_LEVEL:-INFO}
  security_opt:
    - no-new-privileges:true
  cap_drop:
    - ALL
  read_only: true
  tmpfs:
    - /tmp:rw,noexec,nosuid,size=128m
  restart: unless-stopped

services:
  postgres:
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-job_agent}
      POSTGRES_USER: ${POSTGRES_USER:-job_agent}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required in production}
    restart: always
    security_opt:
      - no-new-privileges:true

  redis:
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD is required in production}
    command:
      - /bin/sh
      - -ec
      - |
        umask 077
        printf 'requirepass %s\nappendonly yes\nappendfsync everysec\n' "$${REDIS_PASSWORD}" > /tmp/redis.conf
        exec redis-server /tmp/redis.conf
    healthcheck:
      test: ["CMD-SHELL", "REDISCLI_AUTH=$${REDIS_PASSWORD} redis-cli ping | grep -q PONG"]
    restart: always
    security_opt:
      - no-new-privileges:true

  migrate:
    <<: *production-app
    env_file:
      - path: /etc/jobhunter/migrator.env
        required: true
    environment:
      ENVIRONMENT: production
      DATABASE_URL: ""
      JOBHUNTER_RUNTIME_PREFLIGHT: "1"
      EXPECTED_BUILD_FLAVOR: production
      EXPECTED_APP_REVISION: ${JOBHUNTER_IMAGE_TAG:?JOBHUNTER_IMAGE_TAG is required; use deploy/prod-compose.sh}
      EXPECTED_DATABASE_ROLE: jobhunter_migrator
    restart: "no"
    read_only: true

  api:
    <<: *production-app
    ports:
      - "127.0.0.1:8091:8000"
    volumes:
      - resumes:/data/resumes
      - phone_evidence:/data/phone_evidence:ro

  worker:
    <<: *production-app
    command:
      - celery
      - -A
      - app.scheduler.celery_app:celery_app
      - worker
      - --loglevel=${LOG_LEVEL:-INFO}
      - --hostname=crawler@%h
      - --queues=crawling,celery
      - --pool=prefork
      - --concurrency=1
      - --max-tasks-per-child=20
      - --max-memory-per-child=600000
    volumes:
      - resumes:/data/resumes:ro
      - phone_evidence:/data/phone_evidence

  matching-worker:
    <<: *production-build
    env_file:
      - path: .env
        required: false
    environment:
      <<: *production-environment
    command:
      - celery
      - -A
      - app.scheduler.celery_app:celery_app
      - worker
      - --loglevel=${LOG_LEVEL:-INFO}
      - --hostname=matching@%h
      - --queues=matching,applications
      - --pool=prefork
      - --concurrency=1
      - --max-tasks-per-child=20
      - --max-memory-per-child=450000
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    volumes:
      - resumes:/data/resumes:ro
    networks:
      - backend
    init: true
    healthcheck:
      test: ["CMD-SHELL", "test -r /proc/1/status"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=128m
    restart: unless-stopped
    stop_grace_period: 45s

  proxy-worker:
    <<: *production-build
    env_file:
      - path: .env
        required: false
    environment:
      <<: *production-environment
    command:
      - celery
      - -A
      - app.scheduler.celery_app:celery_app
      - worker
      - --loglevel=${LOG_LEVEL:-INFO}
      - --hostname=proxy@%h
      - --queues=proxy-maintenance
      - --pool=prefork
      - --concurrency=1
      - --max-tasks-per-child=10
      - --max-memory-per-child=350000
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    networks:
      - backend
    init: true
    healthcheck:
      test: ["CMD-SHELL", "test -r /proc/1/status"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=128m
    restart: unless-stopped
    stop_grace_period: 45s

  control-worker:
    <<: *production-build
    env_file:
      - path: .env
        required: false
    environment:
      <<: *production-environment
    command:
      - celery
      - -A
      - app.scheduler.celery_app:celery_app
      - worker
      - --loglevel=${LOG_LEVEL:-INFO}
      - --hostname=control@%h
      - --queues=email,reports,maintenance,phone
      - --pool=solo
    depends_on:
      migrate:
        condition: service_completed_successfully
      redis:
        condition: service_healthy
    volumes:
      - resumes:/data/resumes:ro
      - phone_evidence:/data/phone_evidence
    networks:
      - backend
    init: true
    healthcheck:
      test: ["CMD-SHELL", "test -r /proc/1/status"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=128m
    restart: unless-stopped
    stop_grace_period: 45s

  beat:
    <<: *production-app

  call-agent:
    <<: *production-app
    command: ["job-agent", "phone-agent"]
    volumes:
      - phone_evidence:/data/phone_evidence

  caddy:
    profiles: ["container-edge"]
    environment:
      CADDY_ADDRESS: ${CADDY_ADDRESS:?CADDY_ADDRESS is required in production}
    restart: always
    security_opt:
      - no-new-privileges:true

  fixture-site:
    profiles: ["never-production"]

  backup:
    image: jobhunter-backup-prod:${JOBHUNTER_IMAGE_TAG:?JOBHUNTER_IMAGE_TAG is required; use deploy/prod-compose.sh}
    build:
      context: .
      dockerfile: deploy/backup.Dockerfile
      args:
        APP_REVISION: ${JOBHUNTER_IMAGE_TAG:?JOBHUNTER_IMAGE_TAG is required; use deploy/prod-compose.sh}
    env_file:
      - path: /etc/jobhunter/migrator.env
        required: true
    environment:
      POSTGRES_HOST: ""
      POSTGRES_PORT: ""
      POSTGRES_DB: ""
      POSTGRES_USER: ""
      POSTGRES_PASSWORD: ""
      BACKUP_DIR: /backups
    entrypoint: ["python3", "/usr/local/bin/job-agent-backup-entrypoint"]
    security_opt:
      - no-new-privileges:true

  restore:
    image: jobhunter-backup-prod:${JOBHUNTER_IMAGE_TAG:?JOBHUNTER_IMAGE_TAG is required; use deploy/prod-compose.sh}
    build:
      context: .
      dockerfile: deploy/backup.Dockerfile
      args:
        APP_REVISION: ${JOBHUNTER_IMAGE_TAG:?JOBHUNTER_IMAGE_TAG is required; use deploy/prod-compose.sh}
    env_file:
      - path: /etc/jobhunter/migrator.env
        required: true
    environment:
      POSTGRES_HOST: ""
      POSTGRES_PORT: ""
      POSTGRES_DB: ""
      POSTGRES_USER: ""
      POSTGRES_PASSWORD: ""
      BACKUP_DIR: /backups
      BACKUP_FILE: ${BACKUP_FILE:-}
      RESTORE_CONFIRM: ${RESTORE_CONFIRM:-}
    entrypoint: ["python3", "/usr/local/bin/job-agent-restore-entrypoint"]
    security_opt:
      - no-new-privileges:true