# DFIRe 1.8.0 release bundle
# Select exactly one database overlay; see README.md.

services:
  redis:
    image: redis:8-alpine@sha256:9d317178eceac8454a2284a9e6df2466b93c745529947f0cd42a0fa9609d7005
    container_name: dfire_redis_prod
    command:
      - sh
      - -c
      - 'exec redis-server --appendonly yes $${REDIS_PASSWORD:+--requirepass "$$REDIS_PASSWORD"}'
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      REDISCLI_AUTH: ${REDIS_PASSWORD:-}
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - dfire_internal

  backend:
    image: dfireadmin/dfire-backend:1.8.0@sha256:8e45189b1aac7a20240322acbc33daf778b29cbe4d4cdc3c8ccdce096a9da9e9
    container_name: dfire_backend_prod
    volumes:
      - media_data:/app/media
      - static_data:/app/staticfiles
    environment:
      DEBUG: ${DEBUG:-false}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required}
      REDIS_HOST: ${REDIS_HOST:-redis}
      REDIS_PORT: ${REDIS_PORT:-6379}
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      ALLOWED_HOSTS: ${ALLOWED_HOSTS:?ALLOWED_HOSTS is required}
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:?CORS_ALLOWED_ORIGINS is required}
      CSRF_TRUSTED_ORIGINS: ${CSRF_TRUSTED_ORIGINS:?CSRF_TRUSTED_ORIGINS is required}
      TRUST_PROXY_HEADERS: ${TRUST_PROXY_HEADERS:-false}
      DFIRE_ENVIRONMENT: ${DFIRE_ENVIRONMENT:-production}
      CREDENTIAL_ENCRYPTION_KEY: ${CREDENTIAL_ENCRYPTION_KEY:?CREDENTIAL_ENCRYPTION_KEY is required}
      AUTH_COOKIE_SECURE: ${AUTH_COOKIE_SECURE:-True}
      GUNICORN_WORKERS: ${GUNICORN_WORKERS:-2}
      DJANGO_SUPERUSER_EMAIL: ${DJANGO_SUPERUSER_EMAIL:-}
      DJANGO_SUPERUSER_PASSWORD: ${DJANGO_SUPERUSER_PASSWORD:-}
      DJANGO_SUPERUSER_USERNAME: ${DJANGO_SUPERUSER_USERNAME:-}
    depends_on:
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/api/health/"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 300s
    restart: unless-stopped
    networks:
      - dfire_internal
      - dfire_external

  qcluster:
    image: dfireadmin/dfire-backend:1.8.0@sha256:8e45189b1aac7a20240322acbc33daf778b29cbe4d4cdc3c8ccdce096a9da9e9
    container_name: dfire_qcluster_prod
    command: python manage.py qcluster
    volumes:
      - media_data:/app/media
    environment:
      DEBUG: ${DEBUG:-false}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required}
      REDIS_HOST: ${REDIS_HOST:-redis}
      REDIS_PORT: ${REDIS_PORT:-6379}
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      DFIRE_ENVIRONMENT: ${DFIRE_ENVIRONMENT:-production}
      CREDENTIAL_ENCRYPTION_KEY: ${CREDENTIAL_ENCRYPTION_KEY:?CREDENTIAL_ENCRYPTION_KEY is required}
      DFIRE_DB_STATEMENT_TIMEOUT_MS: "0"
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - dfire_internal
      - dfire_external

  slack-socket:
    image: dfireadmin/dfire-backend:1.8.0@sha256:8e45189b1aac7a20240322acbc33daf778b29cbe4d4cdc3c8ccdce096a9da9e9
    container_name: dfire_slack_socket_prod
    command: python manage.py run_slack_socket
    volumes:
      - media_data:/app/media
    environment:
      DEBUG: ${DEBUG:-false}
      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required}
      REDIS_HOST: ${REDIS_HOST:-redis}
      REDIS_PORT: ${REDIS_PORT:-6379}
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      DFIRE_ENVIRONMENT: ${DFIRE_ENVIRONMENT:-production}
      CREDENTIAL_ENCRYPTION_KEY: ${CREDENTIAL_ENCRYPTION_KEY:?CREDENTIAL_ENCRYPTION_KEY is required}
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - dfire_internal
      - dfire_external

  frontend:
    image: dfireadmin/dfire-frontend:1.8.0@sha256:252b52aecf37afbcfcf340848847656b3e4a4895070c2b254a4f7321415e1659
    container_name: dfire_frontend_prod
    ports:
      - "${FRONTEND_BIND:-0.0.0.0:8080:80}"
    volumes:
      - static_data:/app/staticfiles:ro
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      # 127.0.0.1, not localhost: nginx listens on IPv4 only, localhost resolves
      # to ::1 first inside the container, and busybox wget does not fall back
      # to IPv4 the way curl does.
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1/health"]
      interval: 30s
      timeout: 3s
      retries: 3
    restart: unless-stopped
    networks:
      - dfire_internal
      - dfire_external

volumes:
  postgres_data:
  redis_data:
  media_data:
  static_data:

networks:
  dfire_internal:
    driver: bridge
    internal: true
  dfire_external:
    driver: bridge