docker-compose.prod.yml

volumes:
  node-data: {}
  postgres_db: {}
  files_cache: {}

services:
  # Hasura GraphQL Engine
  hasura:
    image: hasura/graphql-engine:v2.40.0.cli-migrations-v3
    volumes:
      - ./apps/hasura/metadata:/hasura-metadata
      - ./apps/hasura/migrations:/hasura-migrations
    restart: unless-stopped
    environment:
      # Essential Environment Variables
      HASURA_GRAPHQL_METADATA_DATABASE_URL: ${DATABASE_URL}
      HASURA_GRAPHQL_DATABASE_URL: ${DATABASE_URL}
      HASURA_GRAPHQL_ADMIN_SECRET: ${HASURA_GRAPHQL_ADMIN_SECRET} # Admin access secret
      HASURA_GRAPHQL_JWT_SECRET: ${HASURA_GRAPHQL_JWT_SECRET} # JWT authentication secret

      # Console and Development Mode
      HASURA_GRAPHQL_ENABLE_CONSOLE: ${HASURA_GRAPHQL_ENABLE_CONSOLE} # Disable console in production
      HASURA_GRAPHQL_DEV_MODE: 'false' # Disable development mode features

      # Role and CORS Settings
      HASURA_GRAPHQL_UNAUTHORIZED_ROLE: anonymous # Default role for unauthenticated users
      HASURA_GRAPHQL_CORS_DOMAIN: ${HASURA_GRAPHQL_CORS_DOMAIN} # Allowed domains for CORS
      HASURA_GRAPHQL_STRINGIFY_NUMERIC_TYPES: 'true'

      # Performance and Connection Settings
      HASURA_GRAPHQL_MAX_CONNECTIONS: 100 # Maximum number of database connections
      HASURA_GRAPHQL_STRIPES: 2 # Number of connection pool stripes
      HASURA_GRAPHQL_CONNECTIONS_PER_STRIPE: 50 # Connections per stripe
      HASURA_GRAPHQL_IDLE_TIMEOUT: 180 # Idle connection timeout in seconds
      HASURA_GRAPHQL_TIMEOUT: 60 # Request timeout in seconds

      # Logging Settings
      HASURA_GRAPHQL_LOG_LEVEL: 'warn' # Log verbosity level
      HASURA_GRAPHQL_ENABLED_LOG_TYPES: 'startup,http-log,webhook-log,websocket-log,query-log' # Enabled log types

      # Security and Authorization
      HASURA_GRAPHQL_ENABLE_ALLOWLIST: 'false' # Disable query allowlisting

    ports:
      - '${HASURA_GRAPHQL_PORT}:8080'
    command:
      - graphql-engine
      - serve
    profiles:
      - base
    logging:
      driver: loki
      options:
        loki-url: 'https://logging.subspace.network/loki/api/v1/push'
  rabbitmq:
    image: rabbitmq:3-management
    ports:
      - '${RABBITMQ_PORT}:5672'
      - '${RABBITMQ_MANAGEMENT_PORT}:15672'
    environment:
      - RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER}
      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS}
    profiles:
      - rabbit
    logging:
      driver: loki
      options:
        loki-url: 'https://logging.subspace.network/loki/api/v1/push'
  backend-worker:
    image: ${BACKEND_IMAGE}
    ports:
      - '${BACKEND_WORKER_PORT}:3000'
    volumes:
      - files_cache:/usr/src/app/apps/backend/.cache
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - PORT=3000
    profiles:
      - frontend
      - frontend-worker
    logging:
      driver: loki
      options:
        loki-url: 'https://logging.subspace.network/loki/api/v1/push'
    command:
      - yarn
      - workspace
      - backend
      - start:fe:worker
  # Dedicated worker for on-chain node publishing. publish-nodes tasks block for
  # the confirmation-depth window (~2.5-5 min per batch), so they run here on
  # their own queue (publish-manager) instead of holding task-manager slots and
  # starving the frontend worker's fast tasks. Shares backend-worker's profiles
  # so it deploys on the same single host that runs start:fe:worker today.
  #
  # IMPORTANT: on-chain publishing must run in exactly ONE process — signing
  # accounts' nonces are tracked in-memory per process, so a second concurrent
  # publisher would hand out colliding nonces. Keep this to a single replica; if
  # you ever run the frontend profile on more than one host, move publishing to
  # its own single-host profile instead of sharing these.
  #
  # Rolling-deploy safety: before this change the frontend worker signed
  # publish-nodes inline, so during the upgrade the OLD start:fe:worker keeps
  # signing until it stops while this new worker also signs — two signers whose
  # in-memory nonces can collide. depends_on: backend-worker makes the standard
  # single-host `docker compose up -d` safe: compose recreates backend-worker
  # (stop old, start new) before starting this worker, so the old inline signer
  # is gone before this one begins. For a non-recreate/rolling or multi-host
  # deploy, stop the old frontend worker before this worker starts signing (or
  # roll out the new frontend workers first, then start this worker).
  #
  # This depends_on recreation only fires when BACKEND_IMAGE actually changes:
  # the ansible deploy sets BACKEND_IMAGE from the new image_tag, which changes
  # backend-worker's config hash and triggers stop-old/start-new. Ship this
  # compose change WITH a new image tag — a compose-only redeploy on an unchanged
  # BACKEND_IMAGE neither recreates backend-worker (so the sequencing is lost)
  # nor finds dist/app/servers/publishWorker.js in the old image (so this worker
  # crash-loops under restart: unless-stopped).
  backend-publish-worker:
    image: ${BACKEND_IMAGE}
    depends_on:
      - backend-worker
    # Publish the worker's health endpoint (apis/worker.ts GET /health) like
    # every other backend service. This is the SOLE on-chain publisher, and the
    # deploy checklist asks operators to confirm exactly one is running, so it is
    # the last process that should lose its probe. BACKEND_PUBLISH_WORKER_PORT
    # must be set in the deploy env (Infisical) alongside BACKEND_WORKER_PORT.
    ports:
      - '${BACKEND_PUBLISH_WORKER_PORT}:3000'
    volumes:
      - files_cache:/usr/src/app/apps/backend/.cache
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - PORT=3000
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:3000/health']
      interval: 15s
      timeout: 10s
      retries: 3
    profiles:
      - frontend
      - frontend-worker
    logging:
      driver: loki
      options:
        loki-url: 'https://logging.subspace.network/loki/api/v1/push'
    command:
      - yarn
      - workspace
      - backend
      - start:publish:worker
  backend-api:
    image: ${BACKEND_IMAGE}
    volumes:
      - files_cache:/usr/src/app/apps/backend/.cache
    ports:
      - '${BACKEND_API_PORT}:3000'
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - PORT=3000
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:3000/health']
      interval: 15s
      timeout: 10s
      retries: 3
    profiles:
      - frontend
      - frontend-api
    logging:
      driver: loki
      options:
        loki-url: 'https://logging.subspace.network/loki/api/v1/push'
    command:
      - yarn
      - workspace
      - backend
      - start:fe:api
  backend-download-worker:
    image: ${BACKEND_IMAGE}
    volumes:
      - files_cache:/usr/src/app/apps/backend/.cache
    restart: unless-stopped
    ports:
      - '${BACKEND_DOWNLOAD_WORKER_PORT}:3000'
    env_file:
      - .env
    environment:
      - PORT=3000
    profiles:
      - download-worker
      - download
    logging:
      driver: loki
      options:
        loki-url: 'https://logging.subspace.network/loki/api/v1/push'
    command:
      - yarn
      - workspace
      - backend
      - start:download:worker
  backend-download-api:
    image: ${BACKEND_IMAGE}
    volumes:
      - files_cache:/usr/src/app/apps/backend/.cache
    ports:
      - '${BACKEND_DOWNLOAD_API_PORT}:3000'
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - PORT=3000
    profiles:
      - download-api
      - download
    logging:
      driver: loki
      options:
        loki-url: 'https://logging.subspace.network/loki/api/v1/push'
    command:
      - yarn
      - workspace
      - backend
      - start:download:api
  agent:
    container_name: newrelic-infra
    image: newrelic/infrastructure:latest
    cap_add:
      - SYS_PTRACE
    network_mode: bridge
    pid: host
    privileged: true
    volumes:
      - '/:/host:ro'
      - '/var/run/docker.sock:/var/run/docker.sock'
    environment:
      NRIA_LICENSE_KEY: '${NR_API_KEY}'
      NRIA_DISPLAY_NAME: '${NR_AGENT_IDENTIFIER}'
    restart: unless-stopped
    profiles:
      - base
    logging:
      driver: loki
      options:
        loki-url: 'https://logging.subspace.network/loki/api/v1/push'