docker-compose.prod.yml

version: "3.8"

x-entrypoint-common-vars: &entrypoint-common-vars
  SECRETS_SOURCE_DIR: /run/secrets
  SECRETS_TARGET_DIR: /app/secrets
  CREATE_ENV_VARS: "true"
  SKIP_USER_SWITCH: "false"

services:
  postgres:
    container_name: api-forge-postgres
    profiles: ["postgres"]  # Only started via db create command
    image: app_data_postgres_image
    build:
      context: ./infra/docker/prod
      dockerfile: postgres/Dockerfile
    shm_size: "1g"
    environment:
      <<: *entrypoint-common-vars
      CERTS_TARGET_DIR: /etc/postgresql/ssl
      CONTAINER_USER_UID: postgres
      CONTAINER_USER_GID: postgres

      # Application DB settings
      APP_DB: ${APP_DB:-appdb}
      APP_DB_USER: ${APP_DB_USER:-appuser}
      APP_DB_OWNER: ${APP_DB_OWNER:-appowner}
      APP_DB_RO_USER: ${APP_DB_RO_USER:-backupuser}

      # Temporal DB settings
      TEMPORAL_DB: ${TEMPORAL_DB:-temporal}
      TEMPORAL_VIS_DB: ${TEMPORAL_VIS_DB:-temporal_visibility}
      TEMPORAL_DB_USER: ${TEMPORAL_DB_USER:-temporaluser}

      POSTGRES_INITDB_ARGS: "--auth-host=scram-sha-256 --data-checksums"

      PGDATA: /var/lib/postgresql/data/pgdata
    secrets:
      - postgres_password
      - postgres_app_owner_pw
      - postgres_app_user_pw
      - postgres_app_ro_pw
      - postgres_temporal_pw
      - source: postgres_tls_cert
        target: server.crt
        mode: 0400
      - source: postgres_tls_key
        target: server.key
        mode: 0400
    entrypoint: ["/opt/entry/start-scripts/universal-entrypoint.sh"]
    command: ["/bin/sh","-lc","/opt/entry/start-scripts/pg-start.sh"]
    ports:
      - "127.0.0.1:5432:5432"
    volumes:
      - ./infra/docker/prod/postgres/init-scripts:/opt/entry/init-scripts:ro
      - /etc/localtime:/etc/localtime:ro
      - postgres_data:/var/lib/postgresql/data
      - postgres_backups:/var/lib/postgresql/backups
      - ./infra/docker/prod/postgres/postgresql.conf:/etc/postgresql/postgresql.conf:ro
      - ./infra/docker/prod/postgres/pg_hba.conf:/etc/postgresql/pg_hba.conf:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -h 127.0.0.1"]
      interval: 5s
      timeout: 5s
      retries: 20
    networks: [backend]

  # NOTE: postgres-verifier has been replaced by the CLI `db verify` command.
  # Run `uv run api-forge-cli db verify` to verify PostgreSQL setup.

  # Redis Cache/Session Store
  redis:
    container_name: api-forge-redis
    image: app_data_redis_image
    build:
      context: ./infra/docker/prod/redis
      dockerfile: Dockerfile
    environment:
      REDIS_PASSWORD_FILE: /run/secrets/redis_password
    volumes:
      - redis_data:/data
      - redis_backups:/var/lib/redis/backups
      - /etc/localtime:/etc/localtime:ro
    networks:
      - backend
    secrets:
      - redis_password
    restart: unless-stopped
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M

  temporal-schema-setup:
    container_name: api-forge-temporal-schema-setup
    image: temporalio/admin-tools:1.29.0-tctl-1.18.4-cli-1.4.2
    user: "0:0"  # Run as root to read Docker secrets and copy them
    restart: "no"
    networks: [backend]
    environment:
      # Universal entrypoint config
      SKIP_USER_SWITCH: "true"  # Stay as root (don't switch to non-root user)
      CREATE_ENV_VARS: "true"
      SECRETS_SOURCE_DIR: /run/secrets
      KEYS_TARGET_DIR: /tmp/secrets
      CERTS_TARGET_DIR: /tmp/certs
      
      # Temporal schema setup config
      TEMPORAL_DB: ${TEMPORAL_DB:-temporal}
      TEMPORAL_VIS_DB: ${TEMPORAL_VIS_DB:-temporal_visibility}
      # EP is parsed from PRODUCTION_DATABASE_URL if not set (supports bundled & external)
      EP: ${PG_HOST:-}
      PRODUCTION_DATABASE_URL: ${PRODUCTION_DATABASE_URL:-}
      TEMPORAL_DB_USER: ${TEMPORAL_DB_USER:-temporaluser}
      PW_FILE: /tmp/secrets/postgres_temporal_pw  # Points to copied secret

      # TLS settings - adjust as needed (can be overridden via .env)
      TLS_ENABLE: ${TEMPORAL_TLS_ENABLE:-true}
      SSL_MODE: ${TEMPORAL_SSL_MODE:-verify-ca}                # verify-ca validates cert against CA bundle
      TLS_CA_FILE: /tmp/certs/ca-bundle.crt  # Points to copied cert
      
      # Optional overrides:
      # PG_PORT: "5432"
      # PLUGIN: postgres12
    secrets:
      - postgres_temporal_pw
      - source: postgres_server_ca
        target: ca-bundle.crt
    volumes:
      - ./infra/docker/prod/temporal/scripts/schema-setup.sh:/schema-setup.sh:ro
      - ./infra/docker/prod/scripts/universal-entrypoint.sh:/universal-entrypoint.sh:ro
    entrypoint: ["/universal-entrypoint.sh"]
    command: ["/bin/sh", "/schema-setup.sh"]


  temporal-admin-tools:
    container_name: api-forge-temporal-admin-tools
    restart: unless-stopped
    image: temporalio/admin-tools:1.29.0-tctl-1.18.4-cli-1.4.2
    networks: [backend]
    environment:
      TEMPORAL_ADDRESS: temporal:7233


  temporal-namespace-init:
    container_name: api-forge-temporal-namespace-init
    image: temporalio/admin-tools:1.29.0-tctl-1.18.4-cli-1.4.2
    depends_on:
      temporal:
        condition: service_healthy
    environment:
      TEMPORAL_ADDRESS: temporal:7233
    volumes:
      - ./infra/docker/prod/temporal/scripts/namespace-init.sh:/scripts/namespace-init.sh:ro
    entrypoint: []  # Override the default 'sleep infinity' entrypoint
    command: ["/scripts/namespace-init.sh"]
    restart: "no"
    networks:
      - backend

  # Temporal Workflow Engine
  temporal:
    container_name: api-forge-temporal
    user: "0:0"  # Start as root to read Docker secrets
    build:
      context: .
      dockerfile: ./infra/docker/prod/temporal/Dockerfile
    image: my-temporal-server:latest
    depends_on:
      temporal-schema-setup:
        condition: service_completed_successfully
    environment:
      # Universal entrypoint config
      SKIP_USER_SWITCH: "false"  # Switch to temporal user after copying secrets
      CONTAINER_USER_UID: "1000"  # Temporal user UID
      CONTAINER_USER_GID: "1000"  # Temporal user GID
      CREATE_ENV_VARS: "true"
      SECRETS_SOURCE_DIR: /run/secrets
      KEYS_TARGET_DIR: /tmp/secrets
      CERTS_TARGET_DIR: /tmp/certs
      
      # Temporal server config
      SERVICES: "history,matching,worker,frontend"
      DB: 'postgres12'
      # POSTGRES_SEEDS parsed from PRODUCTION_DATABASE_URL by entrypoint if not set
      POSTGRES_SEEDS: ${PG_HOST:-}
      PRODUCTION_DATABASE_URL: ${PRODUCTION_DATABASE_URL:-}
      POSTGRES_USER: ${TEMPORAL_DB_USER:-temporaluser}
      POSTGRES_DB: ${TEMPORAL_DB:-temporal}
      # POSTGRES_PWD will be set by wrapper script from POSTGRES_TEMPORAL_PW
      SQL_TLS_ENABLED: "true"
      SQL_CA: /tmp/certs/ca-bundle.crt  # Points to copied cert
      SQL_HOST_VERIFICATION: ${TEMPORAL_SQL_HOST_VERIFICATION:-true}  # Verify cert hostname matches
      SQL_HOST_NAME: ${PG_HOST:-}  # Parsed from PRODUCTION_DATABASE_URL by entrypoint
      BIND_ON_IP: "0.0.0.0"

      #Performance Tuning (optional)
      NUM_HISTORY_SHARDS: 4

      # Temporal DB settings
      DBNAME: ${TEMPORAL_DB:-temporal}
      VISIBILITY_DBNAME: ${TEMPORAL_VIS_DB:-temporal_visibility}
      DB_PORT: ${PG_PORT:-5432}  # Parsed from PRODUCTION_DATABASE_URL by entrypoint
    healthcheck:
      # Probes Temporal's gRPC health endpoint on the frontend (7233)
      test: ["CMD", "grpc_health_probe", "-addr=127.0.0.1:7233", "-service=temporal.api.workflowservice.v1.WorkflowService"]
      interval: 5s
      timeout: 3s
      retries: 30
      start_period: 15s

    volumes:
      - temporal_certs:/etc/temporal/certs
      - /etc/localtime:/etc/localtime:ro
      - ./infra/docker/prod/scripts/universal-entrypoint.sh:/universal-entrypoint.sh:ro
      - ./infra/docker/prod/temporal/scripts/entrypoint.sh:/temporal-entrypoint.sh:ro
      #- ./infra/docker/temporal/new/config:/etc/temporal/config
    secrets:
      - postgres_temporal_pw
      - source: postgres_server_ca
        target: ca-bundle.crt
    ports:
      - 127.0.0.1:7233:7233
    entrypoint: ["/universal-entrypoint.sh"]
    command: ["/temporal-entrypoint.sh"]
    networks:
      - backend
    # Remove the secrets section since we're using volume mounts + tmpfs
    restart: unless-stopped
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 256M

  temporal-web:
    container_name: api-forge-temporal-web
    image: temporalio/ui:2.34.0
    depends_on:
      - temporal
    environment:
      - TEMPORAL_ADDRESS=temporal:7233
      #- TEMPORAL_CORS_ORIGINS=http://localhost:3000
    networks:
      - backend
    ports:
      - 127.0.0.1:8081:8080

  # FastAPI Application
  app:
    container_name: api-forge-app
    build:
      context: .
      dockerfile: Dockerfile
    image: api-forge-app:latest
    depends_on:
      redis:
        condition: service_started
      temporal:
        condition: service_healthy
      temporal-namespace-init:
        condition: service_completed_successfully
    env_file:
      - .env
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN           # Required for entrypoint to change file ownership
      - DAC_OVERRIDE    # Required to bypass file permission checks as root
      - FOWNER          # Required for entrypoint to override file permissions
      - SETUID          # Required for gosu/su-exec to drop privileges
      - SETGID          # Required for gosu/su-exec to drop privileges
      #- NET_BIND_SERVICE  # Only if needed for port 80/443
    #read_only: true  # If filesystem doesn't need writes
    tmpfs:
    - /tmp:noexec,nosuid,nodev,size=100m
    environment:
      <<: *entrypoint-common-vars
      CONTAINER_USER_UID: appuser
      CONTAINER_USER_GID: appgroup

      # Application settings
      APP_ENVIRONMENT: production
      APP_HOST: 0.0.0.0
      APP_PORT: 8000
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      LOG_FORMAT: json
      
    secrets:
      - postgres_app_user_pw
      - redis_password
      - session_signing_secret
      - csrf_signing_secret
      - oidc_google_client_secret
      - oidc_microsoft_client_secret
      - oidc_keycloak_client_secret
    
    volumes:
      - ./config.yaml:/app/config.yaml:ro
      - app_logs:/app/logs
      - /etc/localtime:/etc/localtime:ro
    
    ports:
      - "8000:8000"
    
    networks:
      - backend
    
    restart: unless-stopped
    
    healthcheck:
      test: ["CMD", "python", "-c", "import httpx; httpx.get('http://localhost:8000/health', timeout=5)"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M

  # Temporal Worker
  worker:
    container_name: api-forge-worker
    build:
      context: .
      dockerfile: Dockerfile
    image: api-forge-app:latest
    depends_on:
      redis:
        condition: service_started
      temporal:
        condition: service_healthy
      temporal-namespace-init:
        condition: service_completed_successfully
    env_file:
      - .env
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN           # Required for entrypoint to change file ownership
      - DAC_OVERRIDE    # Required to bypass file permission checks as root
      - FOWNER          # Required for entrypoint to override file permissions
      - SETUID          # Required for gosu/su-exec to drop privileges
      - SETGID          # Required for gosu/su-exec to drop privileges
    tmpfs:
    - /tmp:noexec,nosuid,nodev,size=100m
    environment:
      <<: *entrypoint-common-vars
      CONTAINER_USER_UID: appuser
      CONTAINER_USER_GID: appgroup

      # Application settings
      APP_ENVIRONMENT: production
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      LOG_FORMAT: json
      
    secrets:
      - postgres_app_user_pw
      - redis_password
      - session_signing_secret
      - csrf_signing_secret
      - oidc_google_client_secret
      - oidc_microsoft_client_secret
      - oidc_keycloak_client_secret
    
    volumes:
      - ./config.yaml:/app/config.yaml:ro
      - app_logs:/app/logs
      - /etc/localtime:/etc/localtime:ro
    
    networks:
      - backend
    
    restart: unless-stopped
    
    command: ["python", "-m", "src.worker.main", "--log-level", "INFO"]
    
    healthcheck:
      test: ["CMD", "python", "/app/src/worker/health_check.py"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M

# Volume Configuration
volumes:
  postgres_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${DATA_PATH:-./data}/postgres
  postgres_backups:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${DATA_PATH:-./data}/postgres-backups
  postgres_ssl:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${DATA_PATH:-./data}/postgres-ssl

  redis_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${DATA_PATH:-./data}/redis
  
  redis_backups:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${DATA_PATH:-./data}/redis-backups

  # FOR TESTING ONLY - Temporal certs (if using TLS). DELETE after testing.
  temporal_certs:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${DATA_PATH:-./data}/temporal-certs

  # Application logs
  app_logs:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${DATA_PATH:-./data}/app-logs

# Secrets Configuration
secrets:
  postgres_password:
    file: ./infra/secrets/keys/postgres_password.txt
  postgres_app_owner_pw:
    file: ./infra/secrets/keys/postgres_app_owner_pw.txt
  postgres_app_user_pw:
    file: ./infra/secrets/keys/postgres_app_user_pw.txt
  postgres_app_ro_pw:
    file: ./infra/secrets/keys/postgres_app_ro_pw.txt


  # TLS secrets (example)
  postgres_tls_cert:
    file: ./infra/secrets/certs/postgres/server-chain-no-root.crt
  postgres_tls_key:
    file: ./infra/secrets/certs/postgres/server.key
  postgres_server_ca:
    file: ./infra/secrets/certs/ca-bundle.crt # CA cert for TLS

  # Redis password
  redis_password:
    file: ./infra/secrets/keys/redis_password.txt

  # Temporal Postgres user password
  postgres_temporal_pw:
    file: ./infra/secrets/keys/postgres_temporal_pw.txt

  # Application secrets
  session_signing_secret:
    file: ./infra/secrets/keys/session_signing_secret.txt
  csrf_signing_secret:
    file: ./infra/secrets/keys/csrf_signing_secret.txt
  oidc_google_client_secret:
    file: ./infra/secrets/keys/oidc_google_client_secret.txt
  oidc_microsoft_client_secret:
    file: ./infra/secrets/keys/oidc_microsoft_client_secret.txt
  oidc_keycloak_client_secret:
    file: ./infra/secrets/keys/oidc_keycloak_client_secret.txt

networks:
  backend:
    name: application_internal
    driver: bridge
    ipam:
      config:
        - subnet: 172.30.50.0/24
          gateway: 172.30.50.1