docker-compose.yml

# Default JSON log rotation for every service — without this the json-file
# driver grows unbounded and eventually fills the host disk.
x-logging: &default-logging
  driver: json-file
  options:
    max-size: "10m"
    max-file: "5"

services:
  # --- LiveKit Server (WebRTC SFU) ---
  livekit:
    image: livekit/livekit-server:latest
    restart: unless-stopped
    ports:
      - "127.0.0.1:7880:7880"
      - "3478:3478/udp"
      - "7881:7881"
      - "50000-50200:50000-50200/udp"
    volumes:
      - ./livekit.yaml:/etc/livekit.yaml
    command: --config /etc/livekit.yaml
    depends_on:
      eam-meet-redis:
        condition: service_healthy
    mem_limit: 768m
    logging: *default-logging
    networks:
      - eam-meet

  # --- LiveKit Egress (meeting recording → /recordings) ---
  egress:
    image: livekit/egress:latest
    restart: unless-stopped
    environment:
      - EGRESS_CONFIG_FILE=/etc/egress.yaml
    volumes:
      - ./egress.yaml:/etc/egress.yaml
      - eam-meet-recordings:/recordings
    cap_add:
      - SYS_ADMIN          # required by egress for the headless Chrome sandbox
    shm_size: "1gb"        # Chrome uses /dev/shm; default 64m crashes the compositor
    depends_on:
      eam-meet-redis:
        condition: service_healthy
      livekit:
        condition: service_started
    # Each recording launches a headless Chrome (~1.5-2 GB). Cap it so a runaway
    # (or a 2nd concurrent recording) can't OOM the rest of the host — the
    # recording fails instead of taking down the box.
    mem_limit: 3g
    # Capped at 2 so a recording can't monopolize the (4-core) host and starve
    # the SFU. NOTE: room_composite needs ~4 CPU by default — egress.yaml lowers
    # room_composite_cpu_cost so recording is admitted within this 2-CPU cap.
    cpus: 2.0
    logging: *default-logging
    networks:
      - eam-meet

  # --- Next.js App ---
  eam-meet:
    build: ./app
    restart: unless-stopped
    ports:
      - "127.0.0.1:3100:3000"
    env_file: .env
    environment:
      - NODE_ENV=production
      - SPEAKER_AUDIO_DIR=/speaker-audio
      - TASK_FILES_DIR=/task-files
      - BASE_FILES_DIR=/base-files
    volumes:
      - eam-meet-recordings:/recordings   # read recordings written by egress
      - eam-meet-speaker-audio:/speaker-audio   # read per-speaker audio for re-transcription
      - eam-meet-task-files:/task-files   # task attachment uploads
      - eam-meet-base-files:/base-files   # database (base) cell attachments
    depends_on:
      eam-meet-db:
        condition: service_healthy
      eam-meet-redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000/api/setup/status >/dev/null 2>&1 || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 40s
    mem_limit: 1g
    logging: *default-logging
    networks:
      - eam-meet

  # --- LiveKit Agent (Python) ---
  livekit-agent:
    build: ./agent
    restart: unless-stopped
    env_file: .env
    environment:
      - LIVEKIT_URL=ws://livekit:7880
      - SPEAKER_AUDIO_DIR=/speaker-audio
    volumes:
      - eam-meet-speaker-audio:/speaker-audio   # per-speaker audio (detection + re-transcription)
    depends_on:
      livekit:
        condition: service_started
      eam-meet-db:
        condition: service_healthy
      eam-meet-redis:
        condition: service_healthy
    mem_limit: 768m
    logging: *default-logging
    networks:
      - eam-meet

  # --- Scheduler (reminders, weekly digest, recording retention, reg-cleanup) ---
  # Replaces the host crontab: runs Garely's periodic jobs against the app's
  # internal API on the compose network. CRON_SECRET comes from .env.
  cron:
    build: ./cron
    restart: unless-stopped
    env_file: .env
    depends_on:
      eam-meet:
        condition: service_healthy
    mem_limit: 64m
    logging: *default-logging
    networks:
      - eam-meet

  # --- PostgreSQL ---
  eam-meet-db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - eam-meet-pgdata:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5433:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 3s
      retries: 5
    mem_limit: 1g
    logging: *default-logging
    networks:
      - eam-meet

  # --- Automated database backups (rotated daily pg_dump → volume) ---
  # On-host snapshots only; copy /backups (or the volume) off-box for real DR.
  db-backup:
    image: postgres:16-alpine
    restart: unless-stopped
    env_file: .env
    volumes:
      - eam-meet-backups:/backups
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        set -o pipefail
        echo "[backup] sidecar started — daily pg_dump (pipefail on), keeping 14"
        while true; do
          ts=$$(date +%F-%H%M)
          final="/backups/ezmeet-$$ts.sql.gz"
          tmp="$$final.partial"
          rm -f /backups/*.partial   # clear any leftover from a crashed run
          # pipefail makes the pipeline fail when pg_dump fails, not only when gzip fails:
          # a truncated dump used to exit 0 and get rotated in over a good backup. Write to a
          # .partial (which the rotation glob never matches) and atomically rename only on a
          # successful, NON-EMPTY dump, so a bad night can never destroy prior backups.
          if PGPASSWORD="$$POSTGRES_PASSWORD" pg_dump -h eam-meet-db -U "$$POSTGRES_USER" "$$POSTGRES_DB" | gzip > "$$tmp" && [ -s "$$tmp" ]; then
            mv "$$tmp" "$$final"
            echo "[backup] wrote ezmeet-$$ts.sql.gz ($$(wc -c < "$$final") bytes)"
          else
            echo "[backup] FAILED at $$ts — prior backups kept intact"; rm -f "$$tmp"
          fi
          ls -1t /backups/ezmeet-*.sql.gz 2>/dev/null | tail -n +15 | xargs -r rm -f
          sleep 86400
        done
    depends_on:
      eam-meet-db:
        condition: service_healthy
    mem_limit: 256m
    logging: *default-logging
    networks:
      - eam-meet

  # --- Redis (LiveKit + Egress coordination) ---
  eam-meet-redis:
    image: redis:7.2-alpine
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD} --maxmemory 256mb --maxmemory-policy noeviction
    volumes:
      - eam-meet-redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    mem_limit: 384m
    logging: *default-logging
    networks:
      - eam-meet

  # --- Garely RDP Gateway (adopted Devolutions Gateway) — §15 servers/remote-access pillar ---
  # NOT defined here on purpose. The gateway is an OPT-IN overlay, pinned + wired for a
  # host-nginx front (loopback :7171) in `docker-compose.rdp.yml`. Set up first:
  #   ./rdp-gateway/setup-keys.sh        # generates provisioner/delegation/TLS keys
  # then paste the printed RDP_GW_* values into .env (the app signs connection tokens
  # with the provisioner key + JWE-encrypts injected credentials to the delegation key).
  # Bring it up with:
  #   docker compose -f docker-compose.yml -f docker-compose.rdp.yml up -d garely-rdp-gw
  # Keep it out of THIS file: a second definition would merge with the overlay's (compose
  # APPENDS volume lists), producing two mounts on the same container path.

volumes:
  eam-meet-pgdata:
  eam-meet-redis-data:
  eam-meet-recordings:
  eam-meet-speaker-audio:
  eam-meet-task-files:
  eam-meet-base-files:
  eam-meet-backups:

networks:
  eam-meet:
    driver: bridge