name: rentaldrivego-prod

x-node-runtime-hardening: &node-runtime-hardening
  init: true
  user: "10001:10001"
  entrypoint: []
  security_opt:
    - no-new-privileges:true
  tmpfs:
    - /tmp:size=64m,mode=1777

services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    networks:
      - internal
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-rentaldrivego}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$${POSTGRES_USER}\" -d \"$${POSTGRES_DB}\""]
      interval: 5s
      timeout: 5s
      retries: 10
    volumes:
      - postgres_prod_data:/var/lib/postgresql/data

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    networks:
      - internal
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
    command: >
      sh -ec 'exec redis-server --appendonly yes --requirepass "$${REDIS_PASSWORD}" --maxmemory "$${REDIS_MAXMEMORY:-256mb}" --maxmemory-policy allkeys-lru'
    healthcheck:
      test: ["CMD-SHELL", 'redis-cli -a "$${REDIS_PASSWORD}" ping | grep PONG']
      interval: 10s
      timeout: 5s
      retries: 10
    volumes:
      - redis_prod_data:/data

  migrate:
    <<: *node-runtime-hardening
    image: ${APP_IMAGE:-rentaldrivego/carmanagement}:${IMAGE_TAG:-latest}
    build:
      context: .
      dockerfile: Dockerfile.production
      args:
        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
        NEXT_PUBLIC_HOMEPAGE_URL: ${NEXT_PUBLIC_HOMEPAGE_URL}
        NEXT_PUBLIC_CARPLACE_URL: ${NEXT_PUBLIC_CARPLACE_URL:-${SITE_ORIGIN}/carplace}
        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
        SITE_ORIGIN: ${SITE_ORIGIN}
    command: ["npm", "run", "db:deploy"]
    networks:
      - internal
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - ${APP_ENV_FILE:-.env.production}
    environment:
      DATABASE_URL_FROM_POSTGRES: ${DATABASE_URL_FROM_POSTGRES:-true}
      POSTGRES_HOST: ${POSTGRES_HOST:-postgres}
      POSTGRES_PORT: ${POSTGRES_PORT:-5432}
      POSTGRES_DB: ${POSTGRES_DB:-rentaldrivego}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
    restart: "no"

  api:
    <<: *node-runtime-hardening
    image: ${APP_IMAGE:-rentaldrivego/carmanagement}:${IMAGE_TAG:-latest}
    build:
      context: .
      dockerfile: Dockerfile.production
      args:
        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
        NEXT_PUBLIC_HOMEPAGE_URL: ${NEXT_PUBLIC_HOMEPAGE_URL}
        NEXT_PUBLIC_CARPLACE_URL: ${NEXT_PUBLIC_CARPLACE_URL:-${SITE_ORIGIN}/carplace}
        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
        SITE_ORIGIN: ${SITE_ORIGIN}
    healthcheck:
      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:4000/health', (r) => process.exit(r.statusCode < 400 ? 0 : 1)).on('error', () => process.exit(1))\""]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 60s
    command: ["npm", "run", "start", "--workspace", "@rentaldrivego/api"]
    networks:
      - internal
      - traefik-proxy
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    env_file:
      - ${APP_ENV_FILE:-.env.production}
    environment:
      DATABASE_URL_FROM_POSTGRES: ${DATABASE_URL_FROM_POSTGRES:-true}
      FILE_STORAGE_ROOT: /var/lib/rentaldrivego/storage
      NEXT_PUBLIC_CARPLACE_URL: ${NEXT_PUBLIC_CARPLACE_URL:-${SITE_ORIGIN}/carplace}
      POSTGRES_HOST: ${POSTGRES_HOST:-postgres}
      POSTGRES_PORT: ${POSTGRES_PORT:-5432}
      POSTGRES_DB: ${POSTGRES_DB:-rentaldrivego}
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
    volumes:
      - api_uploads:/var/lib/rentaldrivego/storage
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.routers.api.rule=Host(`${API_DOMAIN}`) && !HeadersRegexp(`x-middleware-subrequest`, `.+`)
      - traefik.http.routers.api.entrypoints=websecure
      - traefik.http.routers.api.tls=true
      - traefik.http.routers.api.tls.certresolver=letsencrypt
      - traefik.http.services.api.loadbalancer.server.port=4000
      - traefik.http.routers.api.middlewares=rdg-security-headers@docker
      - traefik.http.middlewares.rdg-security-headers.headers.stsSeconds=31536000
      - traefik.http.middlewares.rdg-security-headers.headers.stsIncludeSubdomains=true
      - traefik.http.middlewares.rdg-security-headers.headers.contentTypeNosniff=true
      - traefik.http.middlewares.rdg-security-headers.headers.frameDeny=true
      - traefik.http.middlewares.rdg-security-headers.headers.referrerPolicy=strict-origin-when-cross-origin
      - traefik.http.middlewares.rdg-security-headers.headers.permissionsPolicy=camera=(), microphone=(), geolocation=()

  homepage:
    <<: *node-runtime-hardening
    image: ${APP_IMAGE:-rentaldrivego/carmanagement}:${IMAGE_TAG:-latest}
    build:
      context: .
      dockerfile: Dockerfile.production
      args:
        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
        NEXT_PUBLIC_HOMEPAGE_URL: ${NEXT_PUBLIC_HOMEPAGE_URL}
        NEXT_PUBLIC_CARPLACE_URL: ${NEXT_PUBLIC_CARPLACE_URL:-${SITE_ORIGIN}/carplace}
        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
        SITE_ORIGIN: ${SITE_ORIGIN}
    healthcheck:
      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3000/', (r) => process.exit(r.statusCode < 400 ? 0 : 1)).on('error', () => process.exit(1))\""]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 60s
    command: ["npm", "run", "start", "--workspace", "@rentaldrivego/homepage"]
    networks:
      - internal
      - traefik-proxy
    depends_on:
      api:
        condition: service_healthy
    env_file:
      - ${APP_ENV_FILE:-.env.production}
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.routers.homepage.rule=(Host(`${PUBLIC_SITE_DOMAIN}`) || Host(`www.${PUBLIC_SITE_DOMAIN}`)) && !HeadersRegexp(`x-middleware-subrequest`, `.+`)
      - traefik.http.routers.homepage.entrypoints=websecure
      - traefik.http.routers.homepage.tls=true
      - traefik.http.routers.homepage.tls.certresolver=letsencrypt
      - traefik.http.routers.homepage.service=homepage-svc
      - traefik.http.routers.homepage.priority=10
      - traefik.http.services.homepage-svc.loadbalancer.server.port=3000
      - traefik.http.routers.homepage.middlewares=rdg-security-headers@docker

  carplace:
    <<: *node-runtime-hardening
    image: ${APP_IMAGE:-rentaldrivego/carmanagement}:${IMAGE_TAG:-latest}
    build:
      context: .
      dockerfile: Dockerfile.production
      args:
        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
        NEXT_PUBLIC_HOMEPAGE_URL: ${NEXT_PUBLIC_HOMEPAGE_URL}
        NEXT_PUBLIC_CARPLACE_URL: ${NEXT_PUBLIC_CARPLACE_URL:-${SITE_ORIGIN}/carplace}
        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
        SITE_ORIGIN: ${SITE_ORIGIN}
    healthcheck:
      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3004/', (r) => process.exit(r.statusCode < 400 ? 0 : 1)).on('error', () => process.exit(1))\""]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 60s
    command: ["npm", "run", "start", "--workspace", "@rentaldrivego/carplace"]
    networks:
      - internal
      - traefik-proxy
    depends_on:
      api:
        condition: service_healthy
    env_file:
      - ${APP_ENV_FILE:-.env.production}
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.routers.carplace.rule=(Host(`${PUBLIC_SITE_DOMAIN}`) || Host(`www.${PUBLIC_SITE_DOMAIN}`)) && PathPrefix(`/carplace`)
      - traefik.http.routers.carplace.entrypoints=websecure
      - traefik.http.routers.carplace.tls=true
      - traefik.http.routers.carplace.tls.certresolver=letsencrypt
      - traefik.http.routers.carplace.service=carplace-svc
      - traefik.http.routers.carplace.priority=20
      - traefik.http.services.carplace-svc.loadbalancer.server.port=3004
      - traefik.http.routers.carplace.middlewares=rdg-security-headers@docker

  dashboard:
    <<: *node-runtime-hardening
    image: ${APP_IMAGE:-rentaldrivego/carmanagement}:${IMAGE_TAG:-latest}
    build:
      context: .
      dockerfile: Dockerfile.production
      args:
        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
        NEXT_PUBLIC_HOMEPAGE_URL: ${NEXT_PUBLIC_HOMEPAGE_URL}
        NEXT_PUBLIC_CARPLACE_URL: ${NEXT_PUBLIC_CARPLACE_URL:-${SITE_ORIGIN}/carplace}
        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
        SITE_ORIGIN: ${SITE_ORIGIN}
    healthcheck:
      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3001/dashboard', (r) => process.exit(r.statusCode < 400 ? 0 : 1)).on('error', () => process.exit(1))\""]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 60s
    command: ["npm", "run", "start", "--workspace", "@rentaldrivego/dashboard"]
    networks:
      - internal
      - traefik-proxy
    depends_on:
      api:
        condition: service_healthy
    env_file:
      - ${APP_ENV_FILE:-.env.production}
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.routers.dashboard.rule=(Host(`${PUBLIC_SITE_DOMAIN}`) || Host(`www.${PUBLIC_SITE_DOMAIN}`)) && PathPrefix(`/dashboard`) && !HeadersRegexp(`x-middleware-subrequest`, `.+`)
      - traefik.http.routers.dashboard.entrypoints=websecure
      - traefik.http.routers.dashboard.tls=true
      - traefik.http.routers.dashboard.tls.certresolver=letsencrypt
      - traefik.http.routers.dashboard.service=dashboard-svc
      - traefik.http.routers.dashboard.priority=20
      - traefik.http.services.dashboard-svc.loadbalancer.server.port=3001
      - traefik.http.routers.dashboard.middlewares=rdg-security-headers@docker

  admin:
    <<: *node-runtime-hardening
    image: ${APP_IMAGE:-rentaldrivego/carmanagement}:${IMAGE_TAG:-latest}
    build:
      context: .
      dockerfile: Dockerfile.production
      args:
        API_INTERNAL_URL: ${API_INTERNAL_URL:-http://api:4000/api/v1}
        DASHBOARD_INTERNAL_URL: ${DASHBOARD_INTERNAL_URL:-http://dashboard:3001}
        ADMIN_INTERNAL_URL: ${ADMIN_INTERNAL_URL:-http://admin:3002}
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
        NEXT_PUBLIC_HOMEPAGE_URL: ${NEXT_PUBLIC_HOMEPAGE_URL}
        NEXT_PUBLIC_CARPLACE_URL: ${NEXT_PUBLIC_CARPLACE_URL:-${SITE_ORIGIN}/carplace}
        NEXT_PUBLIC_DASHBOARD_URL: ${NEXT_PUBLIC_DASHBOARD_URL}
        NEXT_PUBLIC_ADMIN_URL: ${NEXT_PUBLIC_ADMIN_URL}
        SITE_ORIGIN: ${SITE_ORIGIN}
    healthcheck:
      test: ["CMD-SHELL", "node -e \"require('http').get('http://localhost:3002/admin', (r) => process.exit(r.statusCode < 400 ? 0 : 1)).on('error', () => process.exit(1))\""]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 60s
    command: ["npm", "run", "start", "--workspace", "@rentaldrivego/admin"]
    networks:
      - internal
      - traefik-proxy
    depends_on:
      api:
        condition: service_healthy
    env_file:
      - ${APP_ENV_FILE:-.env.production}
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.routers.admin.rule=(Host(`${PUBLIC_SITE_DOMAIN}`) || Host(`www.${PUBLIC_SITE_DOMAIN}`)) && PathPrefix(`/admin`) && !HeadersRegexp(`x-middleware-subrequest`, `.+`)
      - traefik.http.routers.admin.entrypoints=websecure
      - traefik.http.routers.admin.tls=true
      - traefik.http.routers.admin.tls.certresolver=letsencrypt
      - traefik.http.routers.admin.service=admin-svc
      - traefik.http.routers.admin.priority=20
      - traefik.http.services.admin-svc.loadbalancer.server.port=3002
      - traefik.http.routers.admin.middlewares=rdg-security-headers@docker

  pgmanage:
    image: cmdpromptinc/pgmanage-enterprise:latest
    profiles:
      - private-tools
    restart: unless-stopped
    networks:
      - internal
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGMANAGE_LISTEN_PORT: "8000"
      PGMANAGE_DEFAULT_USERNAME: ${PGMANAGE_DEFAULT_USERNAME:-}
      PGMANAGE_DEFAULT_PASSWORD: ${PGMANAGE_DEFAULT_PASSWORD:-}
      PGMANAGE_LICENSE_KEY: ${PGMANAGE_LICENSE_KEY:-}
      PGMANAGE_SECURE_COOKIES: ${PGMANAGE_SECURE_COOKIES:-True}
    volumes:
      - pgmanage_prod_data:/appdata
      - ./docker/pgmanage/override.py:/appdata/override.py:ro

networks:
  internal:
    driver: bridge
  traefik-proxy:
    external: true

volumes:
  postgres_prod_data:
  redis_prod_data:
  pgmanage_prod_data:
  api_uploads:
    external: true
    name: ${DOCKER_PROD_API_UPLOADS_VOLUME:-rentaldrivego-prod_api_uploads}