docker-compose.yml

x-logging: &default-logging
  driver: "json-file"
  options:
    max-size: "1m"
    max-file: "1"
    tag: "{{.Name}}"

x-common-labels: &default-labels
  logging: "promtail"
  logging_jobname: "containerlogs"
  stackname: "milk2meat"

services:
  milk2meat:
    build:
      context: .
      target: production
    container_name: milk2meat
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    environment:
      DJANGO_SETTINGS_MODULE: milk2meat.settings.production
      DEBUG: ${DEBUG:-False}
      PORT: 8000
      ALLOWED_HOSTS: ${DOMAIN_NAME}
      DJANGO_SECRET_KEY: ${DJANGO_SECRET_KEY}
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
      REDIS_KEY_PREFIX: milk2meat
      BREVO_API_KEY: ${BREVO_API_KEY}
      DEFAULT_FROM_EMAIL: ${DEFAULT_FROM_EMAIL}
      EMAIL_RECIPIENTS: ${EMAIL_RECIPIENTS}
      SENTRY_DSN: ${SENTRY_DSN}
      DJANGO_SENTRY_LOG_LEVEL: ${DJANGO_SENTRY_LOG_LEVEL:-20}
      SENTRY_ENVIRONMENT: ${SENTRY_ENVIRONMENT:-production}
      SENTRY_TRACES_SAMPLE_RATE: ${SENTRY_TRACES_SAMPLE_RATE:-0.5}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      AWS_STORAGE_BUCKET_NAME: ${AWS_STORAGE_BUCKET_NAME}
      AWS_S3_ENDPOINT_URL: ${AWS_S3_ENDPOINT_URL}
      TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY}
      TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY}
    networks:
      - traefik-public
      - default
    logging: *default-logging
    labels:
      <<: *default-labels
      docker-volume-backup.stop-during-backup: "true"
      traefik.enable: "true"
      traefik.http.routers.milk2meat.rule: "Host(`${DOMAIN_NAME}`)"
      traefik.http.routers.milk2meat.entrypoints: "websecure"
      traefik.http.routers.milk2meat.tls: "true"
      traefik.http.routers.milk2meat.tls.certresolver: "letsencrypt"
      traefik.http.services.milk2meat.loadbalancer.server.port: "8000"
      traefik.http.middlewares.secHeaders.headers.browserXssFilter: "true"
      traefik.http.middlewares.secHeaders.headers.contentTypeNosniff: "true"
      traefik.http.middlewares.secHeaders.headers.forceSTSHeader: "true"
      traefik.http.middlewares.secHeaders.headers.stsIncludeSubdomains: "true"
      traefik.http.middlewares.secHeaders.headers.stsPreload: "true"
      traefik.http.middlewares.secHeaders.headers.stsSeconds: "31536000"
      traefik.http.routers.milk2meat.middlewares: "secHeaders"

  postgres:
    image: postgres:16.13
    container_name: milk2meat-postgres
    restart: unless-stopped
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - database_dump_data:/tmp/backup
    environment:
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_DB=${POSTGRES_DB}
    networks:
      - default
    logging: *default-logging
    labels:
      <<: *default-labels
      traefik.enable: "false"
      docker-volume-backup.stop-during-backup: "true"
      docker-volume-backup.archive-pre: >-
        /bin/sh -c '
          set -e &&
          mkdir -p /tmp/backup &&
          TIMESTAMP=$$(date +%Y%m%d_%H%M%S) &&
          BACKUP_FILE="/tmp/backup/postgres_dump_$$TIMESTAMP.gz" &&
          LATEST_LINK="/tmp/backup/postgres_dump_latest.gz" &&
          echo "Starting PostgreSQL backup: $$(date)" &&
          PGPASSWORD=${POSTGRES_PASSWORD} pg_dump -Fc --no-acl --no-owner -U ${POSTGRES_USER} -w ${POSTGRES_DB} | gzip > $$BACKUP_FILE &&
          chmod 644 $$BACKUP_FILE &&
          ln -sf $$(basename $$BACKUP_FILE) $$LATEST_LINK &&
          echo "PostgreSQL backup completed successfully: $$BACKUP_FILE ($$(stat -c%s $$BACKUP_FILE) bytes)"
        '
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 30s
      timeout: 10s
      retries: 3

  redis:
    image: redis:7.4
    container_name: milk2meat-redis
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    networks:
      - default
    logging: *default-logging
    labels:
      <<: *default-labels
      traefik.enable: "false"

  backup:
    image: offen/docker-volume-backup:v2.47.2
    container_name: milk2meat-backup
    restart: always
    networks:
      - default
    volumes:
      - database_dump_data:/backup/database_dump:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      # so we can run our cron rules in local timezone
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    environment:
      # Core backup settings
      - BACKUP_FILENAME=milk2meat-backup-%Y%m%d-%H%M%S.tar.gz
      - BACKUP_CRON_EXPRESSION=45 3 * * *
      - BACKUP_RETENTION_DAYS=7

      # Backblaze B2 configuration (S3-compatible API)
      - AWS_ACCESS_KEY_ID=${B2_APPLICATION_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${B2_APPLICATION_KEY}
      - AWS_ENDPOINT=${B2_ENDPOINT}
      - AWS_S3_BUCKET_NAME=${B2_BUCKET_NAME}
      - AWS_REGION=${B2_REGION}

      # Notification settings
      - NOTIFICATION_URLS=${NOTIFICATION_URL}
      - NOTIFICATION_LEVEL=error
    logging: *default-logging
    labels:
      <<: *default-labels
      traefik.enable: "false"

  ofelia:
    image: mcuadros/ofelia:0.3
    container_name: milk2meat-ofelia
    restart: unless-stopped
    depends_on:
      - milk2meat
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    networks:
      - default
    command: daemon --docker
    logging: *default-logging
    labels:
      <<: *default-labels
      traefik.enable: "false"
      # https://pkg.go.dev/github.com/robfig/cron#hdr-CRON_Expression_Format
      ofelia.job-exec.clearsessions.schedule: "@daily"
      ofelia.job-exec.clearsessions.container: "milk2meat"
      ofelia.job-exec.clearsessions.command: "python manage.py clearsessions"

volumes:
  postgres_data:
  database_dump_data:
  redis_data:

networks:
  traefik-public:
    external: true
  default: