# ============================================
# Production Docker Compose Override
# Updated: January 2026 - v4.0
# Port: 9000 (standard for Mawidi)
# Use with: docker compose -f docker-compose.yml -f docker-compose.prod.yml up
# ============================================

services:
  mawidi-app:
    image: mawidi:${TAG:-latest}
    ports:
      - "${PORT:-9000}:9000"
    environment:
      - NODE_ENV=production
      - PORT=9000
      - HOSTNAME=0.0.0.0
      - NEXT_TELEMETRY_DISABLED=1
      # URLs
      - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
      - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
      # Auth
      - NEXTAUTH_URL=${NEXTAUTH_URL}
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      # Database
      - DATABASE_URL=${DATABASE_POOL_URL:-${DATABASE_URL}}
      # Redis
      - REDIS_URL=${REDIS_URL}
      - UPSTASH_REDIS_REST_URL=${UPSTASH_REDIS_REST_URL}
      - UPSTASH_REDIS_REST_TOKEN=${UPSTASH_REDIS_REST_TOKEN}
      # Supabase
      - NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}
      - NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}
      - SUPABASE_SERVICE_ROLE_KEY=${SUPABASE_SERVICE_ROLE_KEY}
      # Stripe configuration (CRITICAL for billing dashboard)
      - NEXT_PUBLIC_STRIPE_PUBLIC_KEY=${NEXT_PUBLIC_STRIPE_PUBLIC_KEY}
      - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY}
      - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET}
      # reCAPTCHA
      - NEXT_PUBLIC_RECAPTCHA_SITE_KEY=${NEXT_PUBLIC_RECAPTCHA_SITE_KEY}
      - RECAPTCHA_SECRET_KEY=${RECAPTCHA_SECRET_KEY}
      - RECAPTCHA_SCORE_THRESHOLD=${RECAPTCHA_SCORE_THRESHOLD:-0.5}
      # SMTP
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT}
      - SMTP_SECURE=${SMTP_SECURE}
      - SMTP_USER=${SMTP_USER}
      - SMTP_PASS=${SMTP_PASS}
      - SMTP_FROM=${SMTP_FROM:-noreply@mawidi.com}
      # Encryption
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      # Memory optimization
      - NODE_OPTIONS=--max-old-space-size=2048 --enable-source-maps
    deploy:
      replicas: ${REPLICAS:-2}
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
        monitor: 60s
        max_failure_ratio: 0.3
        order: start-first
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 5
        window: 120s
      resources:
        limits:
          cpus: "2.0"
          memory: 2048M
        reservations:
          cpus: "1.0"
          memory: 1024M
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:9000/api/health || exit 1"]
      interval: 30s
      timeout: 15s
      retries: 3
      start_period: 60s
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "10"
        labels: "service=mawidi-app,environment=production"
    networks:
      - mawidi-network
    labels:
      - "com.mawidi.service=app"
      - "com.mawidi.environment=production"
      - "com.mawidi.version=4.0"

  mawidi-worker:
    image: mawidi:${TAG:-latest}
    command: ["npm", "run", "sync:process"]
    environment:
      - NODE_ENV=production
      - LOG_SERVICE_NAME=mawidi-worker
      - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
      - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL}
      - DATABASE_URL=${DATABASE_POOL_URL:-${DATABASE_URL}}
      - NEXTAUTH_URL=${NEXTAUTH_URL}
      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
      - REDIS_URL=${REDIS_URL:-redis://mawidi-redis:6379}
      # Stripe configuration for worker
      - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY}
      - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET}
      - NODE_OPTIONS=--max-old-space-size=1536 --enable-source-maps
    deploy:
      replicas: ${WORKER_REPLICAS:-1}
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 5
        window: 120s
      resources:
        limits:
          cpus: "1.0"
          memory: 1536M
        reservations:
          cpus: "0.5"
          memory: 512M
    depends_on:
      - redis
    networks:
      - mawidi-network
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
        labels: "service=mawidi-worker,environment=production"

  nginx:
    image: nginx:alpine
    container_name: mawidi-nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
      - ./nginx/cache:/var/cache/nginx
      - ./nginx/logs:/var/log/nginx
    depends_on:
      - mawidi-app
    networks:
      - mawidi-network
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"
        labels: "service=nginx,environment=production"

  # Redis cache with persistence and optimization
  redis:
    image: redis:7-alpine
    container_name: mawidi-redis
    command: >
      redis-server
      --maxmemory 512mb
      --maxmemory-policy allkeys-lru
      --save 900 1
      --save 300 10
      --save 60 10000
      --appendonly yes
      --appendfsync everysec
      --requirepass ${REDIS_PASSWORD:-mawidi_redis_pass_2025}
    ports:
      - "6379:6379"
    networks:
      - mawidi-network
    restart: unless-stopped
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "redis-cli -a ${REDIS_PASSWORD:-mawidi_redis_pass_2025} ping | grep -q PONG",
        ]
      interval: 10s
      timeout: 5s
      retries: 5
    volumes:
      - redis_data:/data
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Optional: Health check service
  healthcheck:
    image: alpine:latest
    container_name: mawidi-healthcheck
    command: >
      sh -c "
      apk add --no-cache curl &&
      while true; do
        curl -sf http://mawidi-app:9000/api/health || exit 1;
        sleep 30;
      done
      "
    networks:
      - mawidi-network
    restart: unless-stopped
    depends_on:
      - mawidi-app
    profiles:
      - monitoring

networks:
  mawidi-network:
    external: true
    name: mawidi-network

volumes:
  redis_data:
    name: mawidi-redis-data
