# DFIRe 1.12.2 release bundle
# Select exactly one database overlay; see README.md.

x-logging: &default-logging
  # Bounded container logs: 50 MB per file, 10 files, so at most 500 MB per
  # service. Without a cap the JSON log driver grows until the disk is full.
  driver: json-file
  options:
    max-size: "50m"
    max-file: "10"

services:
  redis:
    image: redis:8-alpine@sha256:3811787313eba226a2ef38658c6ccb91cd5e110edc89c37767de373120a0e5a0
    container_name: dfire_redis_prod
    command:
      - sh
      - -c
      - 'exec redis-server --appendonly yes $${REDIS_PASSWORD:+--requirepass "$$REDIS_PASSWORD"}'
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      REDISCLI_AUTH: ${REDIS_PASSWORD:-}
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    logging: *default-logging
    restart: unless-stopped
    networks:
      - dfire_internal

  backend:
    image: dfireadmin/dfire-backend:1.12.2@sha256:9f9122b7cdd6640baf61518d6a6d043c02e88aa3237b6615a622a1a7617ed5ac
    container_name: dfire_backend_prod
    volumes:
      - media_data:/app/media
      - static_data:/app/staticfiles
    environment:
      DEBUG: ${DEBUG:-false}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required}
      REDIS_HOST: ${REDIS_HOST:-redis}
      REDIS_PORT: ${REDIS_PORT:-6379}
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      ALLOWED_HOSTS: ${ALLOWED_HOSTS:?ALLOWED_HOSTS is required}
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:?CORS_ALLOWED_ORIGINS is required}
      CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS:?CSRF_TRUSTED_ORIGINS is required}
      TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
      DFIRE_ENVIRONMENT: ${DFIRE_ENVIRONMENT:-production}
      CREDENTIAL_ENCRYPTION_KEY: ${CREDENTIAL_ENCRYPTION_KEY:?CREDENTIAL_ENCRYPTION_KEY is required}
      AUTH_COOKIE_SECURE: ${AUTH_COOKIE_SECURE:-True}
      GUNICORN_WORKERS: ${GUNICORN_WORKERS:-2}
      DJANGO_SUPERUSER_EMAIL: ${DJANGO_SUPERUSER_EMAIL:-}
      DJANGO_SUPERUSER_PASSWORD: ${DJANGO_SUPERUSER_PASSWORD:-}
      DJANGO_SUPERUSER_USERNAME: ${DJANGO_SUPERUSER_USERNAME:-}
    depends_on:
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/health/"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 300s
    logging: *default-logging
    restart: unless-stopped
    networks:
      - dfire_internal
      - dfire_external

  qcluster:
    image: dfireadmin/dfire-backend:1.12.2@sha256:9f9122b7cdd6640baf61518d6a6d043c02e88aa3237b6615a622a1a7617ed5ac
    container_name: dfire_qcluster_prod
    command: python manage.py qcluster
    volumes:
      - media_data:/app/media
    environment:
      DEBUG: ${DEBUG:-false}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required}
      REDIS_HOST: ${REDIS_HOST:-redis}
      REDIS_PORT: ${REDIS_PORT:-6379}
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      DFIRE_ENVIRONMENT: ${DFIRE_ENVIRONMENT:-production}
      CREDENTIAL_ENCRYPTION_KEY: ${CREDENTIAL_ENCRYPTION_KEY:?CREDENTIAL_ENCRYPTION_KEY is required}
      DFIRE_DB_STATEMENT_TIMEOUT_MS: "0"
    depends_on:
      backend:
        condition: service_healthy
    logging: *default-logging
    restart: unless-stopped
    networks:
      - dfire_internal
      - dfire_external

  slack-socket:
    image: dfireadmin/dfire-backend:1.12.2@sha256:9f9122b7cdd6640baf61518d6a6d043c02e88aa3237b6615a622a1a7617ed5ac
    container_name: dfire_slack_socket_prod
    command: python manage.py run_slack_socket
    volumes:
      - media_data:/app/media
    environment:
      DEBUG: ${DEBUG:-false}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required}
      REDIS_HOST: ${REDIS_HOST:-redis}
      REDIS_PORT: ${REDIS_PORT:-6379}
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      DFIRE_ENVIRONMENT: ${DFIRE_ENVIRONMENT:-production}
      CREDENTIAL_ENCRYPTION_KEY: ${CREDENTIAL_ENCRYPTION_KEY:?CREDENTIAL_ENCRYPTION_KEY is required}
    depends_on:
      backend:
        condition: service_healthy
    logging: *default-logging
    restart: unless-stopped
    networks:
      - dfire_internal
      - dfire_external

  frontend:
    image: dfireadmin/dfire-frontend:1.12.2@sha256:9dbe434ee0bc8ac18bbc7cfe204812e11fe30f0d11f6968759c0f22f34a22983
    container_name: dfire_frontend_prod
    ports:
      - "${FRONTEND_BIND:-0.0.0.0:8080:80}"
    volumes:
      - static_data:/app/staticfiles:ro
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      # 127.0.0.1, not localhost: nginx listens on IPv4 only, localhost resolves
      # to ::1 first inside the container, and busybox wget does not fall back
      # to IPv4 the way curl does.
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1/health"]
      interval: 30s
      timeout: 3s
      retries: 3
    logging: *default-logging
    restart: unless-stopped
    networks:
      - dfire_internal
      - dfire_external

volumes:
  postgres_data:
  redis_data:
  media_data:
  static_data:

networks:
  dfire_internal:
    driver: bridge
    internal: true
  dfire_external:
    driver: bridge