compose.yml

# Rendiff - Production-Grade Media Processing API (Powered by FFmpeg)
# Docker Compose Configuration
# Optimized for performance, security, and maintainability

name: rendiff

services:
  # Traefik Reverse Proxy
  traefik:
    image: traefik:v3.1
    container_name: rendiff_traefik
    command:
      - --configFile=/etc/traefik/traefik.yml
    ports:
      - "8880:80"
      - "8443:443"
      - "8881:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
      - ./traefik/certs:/etc/traefik/certs:ro
    depends_on:
      - api
    networks:
      - rendiff-net
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.localhost`)"
      - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
      - "traefik.http.routers.traefik-dashboard.tls=true"
      - "traefik.http.routers.traefik-dashboard.service=api@internal"
      
  # API Gateway (now behind Traefik)
  krakend:
    image: devopsfaith/krakend:2.7
    container_name: rendiff_gateway
    volumes:
      - ./config/krakend.json:/etc/krakend/krakend.json:ro
    # No port exposure - accessed through Traefik
    depends_on:
      - api
    networks:
      - rendiff-net
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.krakend.rule=Host(`localhost`) && PathPrefix(`/`)"
      - "traefik.http.routers.krakend.entrypoints=websecure"
      - "traefik.http.routers.krakend.tls=true"
      - "traefik.http.services.krakend.loadbalancer.server.port=8080"

  # Database Service
  # WARNING: Default password is for DEVELOPMENT ONLY
  # For production, use compose.prod.yml or set POSTGRES_PASSWORD in .env
  postgres:
    image: postgres:16-alpine
    container_name: rendiff_postgres
    environment:
      POSTGRES_DB: rendiff
      POSTGRES_USER: rendiff_user
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-dev_only_password_change_me}
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
      POSTGRES_HOST_AUTH_METHOD: scram-sha-256
      POSTGRES_INITDB_WALDIR: /var/lib/postgresql/waldir
    volumes:
      - postgres-data:/var/lib/postgresql/data
    ports:
      - "5433:5432"
    networks:
      - rendiff-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U rendiff_user -d rendiff"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    command: >
      postgres 
      -c max_connections=200
      -c shared_buffers=256MB
      -c effective_cache_size=1GB
      -c maintenance_work_mem=64MB
      -c checkpoint_completion_target=0.9
      -c wal_buffers=16MB
      -c default_statistics_target=100
      -c random_page_cost=1.1
      -c effective_io_concurrency=200
      -c max_wal_size=2GB
      -c min_wal_size=1GB
      -c log_statement=none
      -c log_min_duration_statement=1000

  # Queue Service (Redis)
  redis:
    image: redis:7.2-alpine
    container_name: rendiff_redis
    command: >
      redis-server
      --appendonly yes
      --appendfsync everysec
      --maxmemory 2gb
      --maxmemory-policy allkeys-lru
      --timeout 300
      --tcp-keepalive 300
      --maxclients 1000
      --save 900 1
      --save 300 10
      --save 60 10000
      --stop-writes-on-bgsave-error no
      --rdbcompression yes
      --rdbchecksum yes
    volumes:
      - redis-data:/data
      - ./docker/redis/redis.conf:/usr/local/etc/redis/redis.conf:ro
    ports:
      - "6380:6379"
    networks:
      - rendiff-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s

  # Database Migration Service
  db-migrate:
    build:
      context: .
      dockerfile: docker/api/Dockerfile
    command: ["/app/scripts/docker-entrypoint.sh", "migrate"]
    environment:
      DATABASE_URL: postgresql://rendiff_user:dev_password_123@postgres:5432/rendiff_dev
      REDIS_URL: redis://redis:6379/0
      PYTHONUNBUFFERED: "1"
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - rendiff-net
    restart: "no"

  # API Service
  api:
    build:
      context: .
      dockerfile: docker/api/Dockerfile
      # platforms removed for local builds - enable for multi-arch CI builds
    # Note: container_name removed to allow replicas > 1
    environment:
      DATABASE_URL: postgresql://rendiff_user:dev_password_123@postgres:5432/rendiff_dev
      REDIS_URL: redis://redis:6379/0
      STORAGE_CONFIG: /app/config/storage.yml
      LOG_LEVEL: info
      PYTHONUNBUFFERED: "1"
      API_HOST: 0.0.0.0
      API_PORT: "8000"
      API_WORKERS: "4"
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_USER: rendiff_user
      POSTGRES_DB: rendiff_dev
      REDIS_HOST: redis
      REDIS_PORT: "6379"
      # Security headers
      API_CORS_ORIGINS: ${API_CORS_ORIGINS:-"*"}
      API_TRUSTED_HOSTS: ${API_TRUSTED_HOSTS:-"*"}
    volumes:
      - ./storage:/storage
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
    networks:
      - rendiff-net
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "-s", "http://localhost:8000/api/v1/health"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 3
    deploy:
      replicas: 2
      resources:
        limits:
          cpus: '2'
          memory: 4G
        reservations:
          cpus: '1'
          memory: 2G
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`localhost`) && PathPrefix(`/api`)"
      - "traefik.http.routers.api.entrypoints=web"
      - "traefik.http.services.api.loadbalancer.server.port=8000"

  # Worker Service - CPU Only
  worker:
    build:
      context: .
      dockerfile: docker/worker/Dockerfile
      args:
        WORKER_TYPE: cpu
      # platforms removed for local builds - enable for multi-arch CI builds
    # Note: container_name removed to allow replicas > 1
    environment:
      DATABASE_URL: postgresql://rendiff_user:dev_password_123@postgres:5432/rendiff_dev
      REDIS_URL: redis://redis:6379/0
      STORAGE_CONFIG: /app/config/storage.yml
      WORKER_TYPE: cpu
      WORKER_CONCURRENCY: "4"
      LOG_LEVEL: info
      PYTHONUNBUFFERED: "1"
      # Worker optimization
      CELERY_WORKER_PREFETCH_MULTIPLIER: "1"
      CELERY_TASK_ACKS_LATE: "true"
    volumes:
      - ./storage:/storage
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - rendiff-net
    restart: unless-stopped
    deploy:
      replicas: 2
      resources:
        limits:
          cpus: '4'
          memory: 8G
        reservations:
          cpus: '2'
          memory: 4G
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 3

  # Worker Service - GPU (optional)
  worker-gpu:
    build:
      context: .
      dockerfile: docker/worker/Dockerfile
      args:
        WORKER_TYPE: gpu
      platforms:
        - linux/amd64
    container_name: rendiff_worker_gpu
    environment:
      DATABASE_URL: postgresql://rendiff_user:dev_password_123@postgres:5432/rendiff_dev
      REDIS_URL: redis://redis:6379/0
      STORAGE_CONFIG: /app/config/storage.yml
      WORKER_TYPE: gpu
      WORKER_CONCURRENCY: "2"
      LOG_LEVEL: info
      PYTHONUNBUFFERED: "1"
      NVIDIA_VISIBLE_DEVICES: all
      NVIDIA_DRIVER_CAPABILITIES: video,compute,utility
      # Worker optimization
      CELERY_WORKER_PREFETCH_MULTIPLIER: "1"
      CELERY_TASK_ACKS_LATE: "true"
    volumes:
      - ./config:/app/config:ro
      - ./storage:/storage
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - rendiff-net
    restart: unless-stopped
    deploy:
      replicas: 1
      resources:
        limits:
          cpus: '4'
          memory: 8G
        reservations:
          cpus: '2'
          memory: 4G
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 3
    profiles:
      - gpu

  # Monitoring - Prometheus
  prometheus:
    image: prom/prometheus:v2.54.0
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
      - '--web.console.templates=/usr/share/prometheus/consoles'
    volumes:
      - ./config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    ports:
      - "9090:9090"
    networks:
      - rendiff-net
    restart: unless-stopped
    profiles:
      - monitoring

  # Monitoring - Grafana
  # WARNING: Default password is for DEVELOPMENT ONLY
  grafana:
    image: grafana/grafana:11.2.0
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-dev_admin_change_me}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_SECURITY_DISABLE_GRAVATAR: "true"
      GF_SECURITY_COOKIE_SECURE: "true"
      GF_SECURITY_COOKIE_SAMESITE: strict
      GF_SECURITY_STRICT_TRANSPORT_SECURITY: "true"
    volumes:
      - grafana-data:/var/lib/grafana
      - ./monitoring/dashboards:/etc/grafana/provisioning/dashboards:ro
      - ./monitoring/datasources:/etc/grafana/provisioning/datasources:ro
    ports:
      - "3000:3000"
    networks:
      - rendiff-net
    restart: unless-stopped
    depends_on:
      - prometheus
    profiles:
      - monitoring

networks:
  rendiff-net:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.name: br-rendiff
    ipam:
      driver: default
      config:
        - subnet: 172.28.0.0/16
          gateway: 172.28.0.1

volumes:
  storage:
    driver: local
  postgres-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${POSTGRES_DATA_PATH:-./data/postgres}
  redis-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${REDIS_DATA_PATH:-./data/redis}
  prometheus-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${PROMETHEUS_DATA_PATH:-./data/prometheus}
  grafana-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${GRAFANA_DATA_PATH:-./data/grafana}