compose.prod.yml

x-service: &service-defaults
  restart: unless-stopped
  logging:
    driver: json-file
    options:
      max-size: "10m"
      max-file: "3"

x-healthcheck: &healthcheck
  interval: 15s
  timeout: 5s
  retries: 5
  start_period: 15s

services:
  # ── Infrastructure ───────────────────────────────────────────────────

  postgres:
    <<: *service-defaults
    # Intentionally pinned to major version 16 (tracks stable 16.x patches)
    image: postgres:16
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-manifest}
      POSTGRES_USER: ${POSTGRES_USER:-manifest}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-manifest}"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G

  redis:
    <<: *service-defaults
    # Intentionally pinned to major version 7 (tracks stable 7.x patches)
    image: redis:7
    command: redis-server --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD required}
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:?REDIS_PASSWORD required}", "ping"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  minio:
    <<: *service-defaults
    # Pinned: MinIO RELEASE.2025-09-07T16-13-09Z
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-manifest}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      MINIO_API_CORS_ALLOW_ORIGIN: ${MINIO_API_CORS_ALLOW_ORIGIN:-http://localhost:3000}
    volumes:
      - minio_data:/data
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G

  redpanda:
    <<: *service-defaults
    # Pinned: Redpanda v24.3.1
    image: redpandadata/redpanda:v24.3.1
    command:
      - redpanda
      - start
      - --overprovisioned
      - --smp=1
      - --memory=1G
      - --reserve-memory=0M
      - --node-id=0
      - --check=false
      - --kafka-addr=PLAINTEXT://0.0.0.0:9092
      - --advertise-kafka-addr=PLAINTEXT://redpanda:9092
      - --pandaproxy-addr=0.0.0.0:8082
      - --advertise-pandaproxy-addr=redpanda:8082
      - --set
      - auto_create_topics_enabled=true
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:9644/v1/status/ready || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 5
      start_period: 10s
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G

  typesense:
    <<: *service-defaults
    image: typesense/typesense:28.0
    command:
      - --data-dir=/data
      - --api-key=${TYPESENSE_API_KEY:?TYPESENSE_API_KEY is required}
      - --enable-cors
    volumes:
      - typesense_data:/data
    healthcheck:
      test: ["CMD-SHELL", "bash -c ':> /dev/tcp/127.0.0.1/8108' || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G

  traefik:
    <<: *service-defaults
    image: traefik:v3.3
    ports:
      - "${HTTPS_PORT:-443}:443"
      - "${HTTP_PORT:-80}:80"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_certs:/letsencrypt
    command:
      - --api.insecure=false
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.network=public
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.letsencrypt.acme.tlschallenge=true
      - --certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:?ACME_EMAIL is required for TLS}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
    healthcheck:
      test: ["CMD", "traefik", "healthcheck"]
      <<: *healthcheck
    networks: [public]
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 256M

  # ── Observability ────────────────────────────────────────────────────────

  prometheus:
    <<: *service-defaults
    image: prom/prometheus:v2.50.0
    ports:
      - "${PROMETHEUS_PORT:-9090}:9090"
    volumes:
      - ./infra/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./infra/prometheus/alerting_rules.yml:/etc/prometheus/alerting_rules.yml:ro
    depends_on:
      alertmanager:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:9090/-/healthy > /dev/null || exit 1"]
      <<: *healthcheck
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  alertmanager:
    <<: *service-defaults
    image: prom/alertmanager:v0.27.0
    ports:
      - "${ALERTMANAGER_PORT:-9093}:9093"
    volumes:
      - ./infra/alertmanager/alertmanager.yml:/etc/alertmanager/alertmanager.yml:ro
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O - http://localhost:9093/-/healthy > /dev/null || exit 1"]
      <<: *healthcheck
    deploy:
      resources:
        limits:
          cpus: '0.25'
          memory: 256M

  bugsink:
    <<: *service-defaults
    # Pinned: BugSink 0.6.2
    image: bugsink/bugsink:0.6.2
    ports:
      - "${BUGSINK_PORT:-8800}:8000"
    environment:
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/bugsink"
      SECRET_KEY: "${BUGSINK_SECRET_KEY:?BUGSINK_SECRET_KEY is required}"
      BASE_URL: "${BUGSINK_BASE_URL:-http://localhost:8800}"
      PORT: "8000"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:8000/ || exit 1"]
      <<: *healthcheck
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  # ── Backend Services ─────────────────────────────────────────────────

  db-migrator:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/db-migrator:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
    restart: "no"
    depends_on:
      postgres:
        condition: service_healthy
    networks: [internal]

  notification-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/notification-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4010"
      NODE_ENV: production
      KAFKA_BROKERS: "redpanda:9092"
    depends_on:
      redpanda:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4010/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  identity-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/identity-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4005"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GOOGLE_REDIRECT_URI: ${GOOGLE_REDIRECT_URI:-}
      IDENTITY_SERVICE_PUBLIC_URL: ${IDENTITY_SERVICE_PUBLIC_URL:-http://identity-service:4005}
      EMAIL_API_KEY: ${EMAIL_API_KEY:?EMAIL_API_KEY is required for transactional email}
      EMAIL_FROM: ${EMAIL_FROM:-"Script Manifest <noreply@scriptmanifest.com>"}
      FRONTEND_URL: ${FRONTEND_URL:?FRONTEND_URL is required for email links}
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4005/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  profile-project-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/profile-project-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4001"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      NOTIFICATION_SERVICE_URL: "http://notification-service:4010"
      KAFKA_BROKERS: "redpanda:9092"
      TYPESENSE_API_KEY: ${TYPESENSE_API_KEY:?TYPESENSE_API_KEY is required}
      TYPESENSE_HOST: "typesense"
      TYPESENSE_PORT: "8108"
      TYPESENSE_PROTOCOL: "http"
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      notification-service:
        condition: service_healthy
      typesense:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4001/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  competition-directory-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/competition-directory-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4002"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      NOTIFICATION_SERVICE_URL: "http://notification-service:4010"
      KAFKA_BROKERS: "redpanda:9092"
      TYPESENSE_API_KEY: ${TYPESENSE_API_KEY:?TYPESENSE_API_KEY is required}
      TYPESENSE_HOST: "typesense"
      TYPESENSE_PORT: "8108"
      TYPESENSE_PROTOCOL: "http"
      TYPESENSE_ENABLED: "true"
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      notification-service:
        condition: service_healthy
      typesense:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4002/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  script-storage-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/script-storage-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4011"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      STORAGE_BUCKET: "scripts"
      # Browser-reachable URL for upload forms - MUST be externally accessible
      STORAGE_UPLOAD_BASE_URL: ${STORAGE_UPLOAD_BASE_URL:-http://localhost:9000}
      STORAGE_PUBLIC_BASE_URL: ${STORAGE_PUBLIC_BASE_URL:-http://localhost:9000}
      # Internal network URL for S3 client operations
      STORAGE_S3_ENDPOINT: ${STORAGE_S3_ENDPOINT:-http://minio:9000}
      STORAGE_S3_REGION: ${STORAGE_S3_REGION:-us-east-1}
      STORAGE_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-manifest}
      STORAGE_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?MINIO_ROOT_PASSWORD is required}
      STORAGE_S3_FORCE_PATH_STYLE: ${STORAGE_S3_FORCE_PATH_STYLE:-true}
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      minio:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4011/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  submission-tracking-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/submission-tracking-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4004"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4004/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  feedback-exchange-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/feedback-exchange-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4006"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      NOTIFICATION_SERVICE_URL: "http://notification-service:4010"
      KAFKA_BROKERS: "redpanda:9092"
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      notification-service:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4006/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  ranking-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/ranking-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4007"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      NOTIFICATION_SERVICE_URL: "http://notification-service:4010"
      KAFKA_BROKERS: "redpanda:9092"
      SUBMISSION_TRACKING_SERVICE_URL: "http://submission-tracking-service:4004"
      COMPETITION_DIRECTORY_SERVICE_URL: "http://competition-directory-service:4002"
      PROFILE_SERVICE_URL: "http://profile-project-service:4001"
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      notification-service:
        condition: service_healthy
      submission-tracking-service:
        condition: service_healthy
      competition-directory-service:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4007/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  programs-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/programs-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4012"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      NOTIFICATION_SERVICE_URL: "http://notification-service:4010"
      KAFKA_BROKERS: "redpanda:9092"
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      notification-service:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4012/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  partner-dashboard-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/partner-dashboard-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4013"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      RANKING_SERVICE_URL: "http://ranking-service:4007"
      NOTIFICATION_SERVICE_URL: "http://notification-service:4010"
      KAFKA_BROKERS: "redpanda:9092"
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      ranking-service:
        condition: service_healthy
      notification-service:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4013/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  metrics-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/metrics-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4014"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
    healthcheck:
      # metrics-service exposes /healthz instead of the project-standard
      # /health/live; tracked as out-of-scope cleanup in CHAOS-1866.
      test: ["CMD-SHELL", "curl -sf http://localhost:4014/healthz || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  api-gateway:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/api-gateway:${IMAGE_TAG:?IMAGE_TAG is required}
    # For direct debugging without Traefik, re-enable:
    # ports:
    #   - "${API_PORT:-4000}:4000"
    labels:
      traefik.enable: "true"
      traefik.http.routers.api.rule: "Host(`${API_DOMAIN:?API_DOMAIN required}`)"
      traefik.http.routers.api.entrypoints: "websecure"
      traefik.http.routers.api.tls.certresolver: "letsencrypt"
      traefik.http.services.api.loadbalancer.server.port: "4000"
    environment:
      PORT: "4000"
      NODE_ENV: production
      IDENTITY_SERVICE_URL: "http://identity-service:4005"
      PROFILE_SERVICE_URL: "http://profile-project-service:4001"
      COMPETITION_DIRECTORY_SERVICE_URL: "http://competition-directory-service:4002"
      SUBMISSION_TRACKING_SERVICE_URL: "http://submission-tracking-service:4004"
      SCRIPT_STORAGE_SERVICE_URL: "http://script-storage-service:4011"
      FEEDBACK_EXCHANGE_SERVICE_URL: "http://feedback-exchange-service:4006"
      RANKING_SERVICE_URL: "http://ranking-service:4007"
      PROGRAMS_SERVICE_URL: "http://programs-service:4012"
      PARTNER_DASHBOARD_SERVICE_URL: "http://partner-dashboard-service:4013"
      COVERAGE_MARKETPLACE_SERVICE_URL: "http://coverage-marketplace-service:4008"
      INDUSTRY_PORTAL_SERVICE_URL: "http://industry-portal-service:4009"
      METRICS_SERVICE_URL: "http://metrics-service:4014"
      COVERAGE_ADMIN_ALLOWLIST: ${COVERAGE_ADMIN_ALLOWLIST:-}
      INDUSTRY_ADMIN_ALLOWLIST: ${INDUSTRY_ADMIN_ALLOWLIST:-}
      NOTIFICATION_SERVICE_URL: "http://notification-service:4010"
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-}
    depends_on:
      traefik:
        condition: service_healthy
      identity-service:
        condition: service_healthy
      profile-project-service:
        condition: service_healthy
      competition-directory-service:
        condition: service_healthy
      submission-tracking-service:
        condition: service_healthy
      feedback-exchange-service:
        condition: service_healthy
      ranking-service:
        condition: service_healthy
      programs-service:
        condition: service_healthy
      partner-dashboard-service:
        condition: service_healthy
      coverage-marketplace-service:
        condition: service_healthy
      industry-portal-service:
        condition: service_healthy
      script-storage-service:
        condition: service_healthy
      notification-service:
        condition: service_healthy
      metrics-service:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4000/health/live || exit 1"]
      <<: *healthcheck
    networks: [public, internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  coverage-marketplace-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/coverage-marketplace-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4008"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      NOTIFICATION_SERVICE_URL: "http://notification-service:4010"
      KAFKA_BROKERS: "redpanda:9092"
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:?STRIPE_SECRET_KEY is required}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:?STRIPE_WEBHOOK_SECRET is required}
      PLATFORM_COMMISSION_RATE: ${PLATFORM_COMMISSION_RATE:-0.15}
      MINIO_ENDPOINT: "http://minio:9000"
      STORAGE_S3_ENDPOINT: "http://minio:9000"
      STORAGE_S3_ACCESS_KEY: ${MINIO_ROOT_USER:-manifest}
      STORAGE_S3_SECRET_KEY: ${MINIO_ROOT_PASSWORD:?}
      STORAGE_BUCKET: "coverage-reports"
      FRONTEND_URL: ${FRONTEND_URL:-http://localhost:3000}
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      notification-service:
        condition: service_healthy
      minio:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4008/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  industry-portal-service:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/industry-portal-service:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4009"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      SCRIPT_STORAGE_SERVICE_URL: "http://script-storage-service:4011"
      NOTIFICATION_SERVICE_URL: "http://notification-service:4010"
      KAFKA_BROKERS: "redpanda:9092"
      TYPESENSE_API_KEY: ${TYPESENSE_API_KEY:?TYPESENSE_API_KEY is required}
      TYPESENSE_HOST: "typesense"
      TYPESENSE_PORT: "8108"
      TYPESENSE_PROTOCOL: "http"
      TYPESENSE_ENABLED: "true"
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      script-storage-service:
        condition: service_healthy
      notification-service:
        condition: service_healthy
      typesense:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4009/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  search-sync-worker:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/search-sync-worker:${IMAGE_TAG:?IMAGE_TAG is required}
    environment:
      PORT: "4020"
      NODE_ENV: production
      DATABASE_URL: "postgresql://${POSTGRES_USER:-manifest}:${POSTGRES_PASSWORD:?}@postgres:5432/${POSTGRES_DB:-manifest}"
      KAFKA_BROKERS: "redpanda:9092"
      TYPESENSE_API_KEY: ${TYPESENSE_API_KEY:?TYPESENSE_API_KEY is required}
      TYPESENSE_HOST: "typesense"
      TYPESENSE_PORT: "8108"
      TYPESENSE_PROTOCOL: "http"
    depends_on:
      db-migrator:
        condition: service_completed_successfully
      postgres:
        condition: service_healthy
      typesense:
        condition: service_healthy
      redpanda:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:4020/health || exit 1"]
      <<: *healthcheck
    networks: [internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

  # ── Frontend ─────────────────────────────────────────────────────────

  writer-web:
    <<: *service-defaults
    image: ghcr.io/full-chaos/script-manifest/writer-web:${IMAGE_TAG:?IMAGE_TAG is required}
    # For direct debugging without Traefik, re-enable:
    # ports:
    #   - "${WEB_PORT:-3000}:3000"
    labels:
      traefik.enable: "true"
      traefik.http.routers.web.rule: "Host(`${WEB_DOMAIN:?WEB_DOMAIN required}`)"
      traefik.http.routers.web.entrypoints: "websecure"
      traefik.http.routers.web.tls.certresolver: "letsencrypt"
      traefik.http.services.web.loadbalancer.server.port: "3000"
    environment:
      NODE_ENV: production
      HOSTNAME: "0.0.0.0"
      PORT: "3000"
      SCRIPT_STORAGE_SERVICE_URL: "http://script-storage-service:4011"
      API_GATEWAY_URL: "http://api-gateway:4000"
      SCRIPT_UPLOAD_INTERNAL_BASE_URL: ${SCRIPT_UPLOAD_INTERNAL_BASE_URL:-http://minio:9000}
    depends_on:
      traefik:
        condition: service_healthy
      api-gateway:
        condition: service_healthy
      script-storage-service:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://localhost:3000/health/ready || exit 1"]
      <<: *healthcheck
    networks: [public, internal]
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

volumes:
  postgres_data:
  minio_data:
  traefik_certs:
  typesense_data:

networks:
  public:
    driver: bridge
  internal:
    driver: bridge