docker-compose.prod.yml

services:
  # Traefik - Reverse Proxy with automatic HTTPS via Let's Encrypt
  traefik:
    image: traefik:v3.6.4
    container_name: nebi-traefik
    command:
      # API and dashboard (disable in production)
      - --api.insecure=false
      # Docker provider
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      # Entrypoints
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      # HTTP to HTTPS redirect
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      # Let's Encrypt configuration
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
      - --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.caserver=https://acme-v02.api.letsencrypt.org/directory
      # Logging
      - --log.level=DEBUG
      - --accesslog=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt-data:/letsencrypt
    networks:
      - nebi-network
    restart: unless-stopped

  # PostgreSQL 18 - Database
  postgres:
    image: postgres:18
    container_name: nebi-postgres
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-nebi}
      POSTGRES_USER: ${POSTGRES_USER:-nebi}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - nebi-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-nebi}"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Valkey 9.0 - Queue backend (Redis replacement)
  valkey:
    image: valkey/valkey:9.0.0
    container_name: nebi-valkey
    volumes:
      - valkey_data:/data
    networks:
      - nebi-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Nebi API + Worker (both mode)
  # NOTE: Before first deployment, set permissions:
  #   mkdir -p ./data/environments
  #   chown -R 65532:65532 ./data/environments
  nebi-api:
    image: ${NEBI_IMAGE:-quay.io/nebari/nebi:latest}
    container_name: nebi-api
    command: ["/app/nebi", "--mode=both"]
    env_file:
      - .env.prod
    environment:
      # Database configuration
      NEBI_DATABASE_DRIVER: postgres
      NEBI_DATABASE_DSN: postgres://${POSTGRES_USER:-nebi}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nebi}?sslmode=disable
      NEBI_DATABASE_MAX_IDLE_CONNS: 10
      NEBI_DATABASE_MAX_OPEN_CONNS: 100
      NEBI_DATABASE_CONN_MAX_LIFETIME: 60
      # Queue configuration
      NEBI_QUEUE_TYPE: valkey
      NEBI_QUEUE_VALKEY_ADDR: valkey:6379
      # Server configuration
      NEBI_SERVER_PORT: 8460
      NEBI_SERVER_MODE: production
      # Logging
      NEBI_LOG_LEVEL: info
      NEBI_LOG_FORMAT: json
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nebi.rule=Host(`${NEBI_DOMAIN}`)"
      - "traefik.http.routers.nebi.entrypoints=websecure"
      - "traefik.http.routers.nebi.tls=true"
      - "traefik.http.routers.nebi.tls.certresolver=letsencrypt"
      - "traefik.http.services.nebi.loadbalancer.server.port=8460"
    expose:
      - "8460"
    volumes:
      - ./data/environments:/app/data/environments
    networks:
      - nebi-network
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
      traefik:
        condition: service_started
    restart: unless-stopped
    # Health check removed - distroless image has no wget/curl
    # Traefik monitors service health directly

  # Nebi Worker 1 - Additional worker for job processing
  nebi-worker-1:
    image: ${NEBI_IMAGE:-quay.io/nebari/nebi:latest}
    container_name: nebi-worker-1
    command: ["/app/nebi", "--mode=worker"]
    env_file:
      - .env.prod
    environment:
      # Database configuration
      NEBI_DATABASE_DRIVER: postgres
      NEBI_DATABASE_DSN: postgres://${POSTGRES_USER:-nebi}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nebi}?sslmode=disable
      NEBI_DATABASE_MAX_IDLE_CONNS: 10
      NEBI_DATABASE_MAX_OPEN_CONNS: 100
      NEBI_DATABASE_CONN_MAX_LIFETIME: 60
      # Queue configuration
      NEBI_QUEUE_TYPE: valkey
      NEBI_QUEUE_VALKEY_ADDR: valkey:6379
      # Logging
      NEBI_LOG_LEVEL: info
      NEBI_LOG_FORMAT: json
    volumes:
      - ./data/environments:/app/data/environments
    networks:
      - nebi-network
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
      nebi-api:
        condition: service_started
    restart: unless-stopped

  # Nebi Worker 2 - Additional worker for job processing
  nebi-worker-2:
    image: ${NEBI_IMAGE:-quay.io/nebari/nebi:latest}
    container_name: nebi-worker-2
    command: ["/app/nebi", "--mode=worker"]
    env_file:
      - .env.prod
    environment:
      # Database configuration
      NEBI_DATABASE_DRIVER: postgres
      NEBI_DATABASE_DSN: postgres://${POSTGRES_USER:-nebi}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-nebi}?sslmode=disable
      NEBI_DATABASE_MAX_IDLE_CONNS: 10
      NEBI_DATABASE_MAX_OPEN_CONNS: 100
      NEBI_DATABASE_CONN_MAX_LIFETIME: 60
      # Queue configuration
      NEBI_QUEUE_TYPE: valkey
      NEBI_QUEUE_VALKEY_ADDR: valkey:6379
      # Logging
      NEBI_LOG_LEVEL: info
      NEBI_LOG_FORMAT: json
    volumes:
      - ./data/environments:/app/data/environments
    networks:
      - nebi-network
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
      nebi-api:
        condition: service_started
    restart: unless-stopped

volumes:
  letsencrypt-data:
    driver: local
  postgres_data:
    driver: local
  valkey_data:
    driver: local

networks:
  nebi-network:
    name: nebi-network
    driver: bridge