# VPS Production Mode - Optimized and Secure
# Usage: docker-compose -f docker-compose.prod.yml up -d

version: '3.8'

services:
  # Nginx Reverse Proxy with SSL
  nginx:
    image: nginx:alpine
    container_name: ai-cmo-nginx
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./docker/nginx/ssl:/etc/nginx/ssl:ro
      - certbot-data:/etc/letsencrypt
      - certbot-www:/var/www/certbot
      - ./uploads:/var/www/uploads:ro
    depends_on:
      - frontend
      - backend
    networks:
      - ai-cmo-prod

  # MongoDB - Internal only, no exposed port
  mongodb:
    image: mongo:7.0
    container_name: ai-cmo-mongo
    restart: always
    environment:
      MONGO_INITDB_ROOT_USERNAME: ${DB_USER}
      MONGO_INITDB_ROOT_PASSWORD: ${DB_PASSWORD}
      MONGO_INITDB_DATABASE: ${DB_NAME}
    volumes:
      - mongo-data-prod:/data/db
      - ./docker/mongo-init.js:/docker-entrypoint-initdb.d/mongo-init.js:ro
      - ./backups/mongo:/backups
    command: >
      mongod --auth --bind_ip_all
      --wiredTigerCacheSizeGB 1.5
    networks:
      - ai-cmo-prod
    healthcheck:
      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Redis - Internal only with persistence
  redis:
    image: redis:7-alpine
    container_name: ai-cmo-redis
    restart: always
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
    volumes:
      - redis-data-prod:/data
    networks:
      - ai-cmo-prod
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 30s
      timeout: 10s
      retries: 3

  # Backend - Compiled production build
  backend:
    build:
      context: ./src/backend
      dockerfile: ../../docker/Dockerfile.backend.prod
    container_name: ai-cmo-backend
    restart: always
    environment:
      NODE_ENV: production
      PORT: 3001
      MONGODB_URI: mongodb://${DB_USER}:${DB_PASSWORD}@mongodb:27017/${DB_NAME}?authSource=admin
      REDIS_URL: redis://redis:6379
      JWT_SECRET: ${JWT_SECRET}
      # Gateways redirect the buyer back here after payment, so it must be the
      # public app domain — never a loopback address.
      FRONTEND_URL: ${FRONTEND_URL:-https://app.mengoengine.com}
    volumes:
      - ./uploads:/app/uploads
      - backend-logs:/app/logs
    depends_on:
      mongodb:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - ai-cmo-prod
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M

  # Frontend - Production build
  frontend:
    build:
      context: ./src/frontend
      dockerfile: ../../docker/Dockerfile.frontend.prod
      args:
        NEXT_PUBLIC_API_URL: ${BACKEND_URL}/api
    container_name: ai-cmo-frontend
    restart: always
    environment:
      NODE_ENV: production
      PORT: 3000
      NEXT_PUBLIC_API_URL: ${BACKEND_URL}/api
    depends_on:
      - backend
    networks:
      - ai-cmo-prod
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/login"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

volumes:
  mongo-data-prod:
  redis-data-prod:
  certbot-data:
  certbot-www:
  backend-logs:

networks:
  ai-cmo-prod:
    driver: bridge
