docker-compose.yml

services:
  reverse-proxy:
    image: traefik:v3.6.4
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.web.address=:80"
      - "--api.insecure=true"
      - "--entryPoints.traefik.address=:8833"  # ← isolate the API/dashboard entrypoint
      - "--api.dashboard=true"
      - "--log.level=DEBUG"
      - "--ping=true"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.localhost`)"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.entrypoints=traefik"
    container_name: co2-calculator-traefik
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    ports:
      - "127.0.0.1:80:80"
      - "127.0.0.1:8080:8833"
    expose:
      - "80"
      - "8833"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  # PostgreSQL for Auth module
  postgres:
    image: postgres:18-alpine
    container_name: co2-calculator-postgres
    restart: unless-stopped
    env_file:
      - ./backend/.env
      - ./.database.env
    environment:
      POSTGRES_HOST_AUTH_METHOD: "trust"
    ports:
      - "127.0.0.1:5432:5432"
    labels:
      - "traefik.enable=false"
    volumes:
      - postgres-data-18:/var/lib/postgresql
    command: ["postgres", "-c", "listen_addresses=*"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $$DB_URL"]
      interval: 3s
      timeout: 5s
      retries: 5

  pgadmin:
    image: dpage/pgadmin4:latest
    container_name: co2-calculator-pgadmin
    restart: always
    labels:
      - "traefik.enable=false"
    environment:
      PGADMIN_DEFAULT_EMAIL: admin@admin.com
      PGADMIN_DEFAULT_PASSWORD: admin
    volumes:
      - pgadmin_data:/var/lib/pgadmin
    ports:
      - "127.0.0.1:5050:80"
    depends_on:
      - postgres

  # FastAPI Backend
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    container_name: co2-backend
    environment:
      # Local compose only — never True on stage/prod (see app/core/config.py).
      DEBUG: "True"
      HOST: "0.0.0.0"
      PORT: "8000"
      WORKERS: "1"
    command: >
      sh -c '
        alembic upgrade head &&
        exec opentelemetry-instrument uvicorn app.main:app --host $$HOST --port $$PORT --workers $$WORKERS
      '
    env_file:
      - ./backend/.env
    # volumes:
    #   - ./app:/app/app:ro
    labels:
      - "traefik.enable=true"

      # Router
      - "traefik.http.routers.backend.rule=PathPrefix(`/api`)"
      - "traefik.http.routers.backend.entrypoints=web"
      - "traefik.http.routers.backend.priority=200"
      - "traefik.http.routers.backend.middlewares=backend-stripprefix"

      # Middleware
      - "traefik.http.middlewares.backend-stripprefix.stripprefix.prefixes=/api"

      # Service
      - "traefik.http.services.backend.loadbalancer.server.port=8000"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8000/ready"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 20s   # give alembic time to run migrations first
    depends_on:
      postgres:
        condition: service_healthy

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    container_name: co2-frontend
    ports:
      - "127.0.0.1:3000:8080"
    # Match the k8s pod's securityContext (readOnlyRootFilesystem: true plus
    # the three emptyDir mounts in helm/templates/frontend-deployment.yaml).
    # Catches read-only-fs regressions locally before they ship to a cluster
    # — see fix(344): write injectEnv.js to /tmp.
    read_only: true
    tmpfs:
      - /tmp
      - /var/cache/nginx
      - /var/run
    environment:
      # Empty by default. Set in your shell (or repo-root .env) to enable
      # Sentry/GlitchTip from a `docker compose up` run. Same vars the k8s
      # pod receives via helm/values.yaml frontend.env.
      APP_SENTRY_DSN: "${APP_SENTRY_DSN:-}"
      APP_ENVIRONMENT: "${APP_ENVIRONMENT:-compose}"
    labels:
      - "traefik.enable=true"
      # match everything else
      - "traefik.http.routers.frontend.rule=PathPrefix(`/`)"
      - "traefik.http.routers.frontend.entrypoints=web"
      - "traefik.http.routers.frontend.priority=100"
      - "traefik.http.routers.frontend.middlewares=frontend-compress"
      - "traefik.http.middlewares.frontend-compress.compress=true"
      - "traefik.http.services.frontend.loadbalancer.server.port=8080"
    depends_on:
      - backend

  otel:
    image: otel/opentelemetry-collector-contrib:0.86.0
    command: ["--config=/etc/otel-collector-config.yaml"]
    labels:
      - "traefik.enable=false"
    ports:
      - "127.0.0.1:9464:9464"   # Prometheus — host access
      - "127.0.0.1:4317:4317"   # gRPC OTLP — add if you need host access too
    expose:
      - "4317"        # gRPC OTLP — makes it reachable by other containers
      - "4318"        # HTTP OTLP
    volumes:
      - ./otel/otel-collector-config.yaml:/etc/otel-collector-config.yaml:ro


volumes:
  pgadmin_data:
    driver: local
  postgres-data-18:
    driver: local