# {{projectName}} full-stack PROD docker compose.
#
# Builds locked images per app via docker/{api,web}.Dockerfile and
# runs them behind Postgres. No source volumes — each app's code is
# baked in at image-build time. Use this to smoke-test prod config
# locally before deploying.
#
# This is NOT the production deploy target itself — that's helm or
# your cloud provider's container runtime. This file gives parity
# checking on localhost.
#
# Run:
#   pnpm prod:build              # build all images (slow, ~5 min)
#   pnpm prod:up                 # boot the stack
#   pnpm prod:down               # tear down
#
# Different DB user from dev so accidental `pnpm db:reset` against
# the dev compose doesn't wipe a prod-shape dataset you wanted to
# poke at.

services:
  mariadb:
    image: mariadb:11
    container_name: {{projectName}}-mariadb-prod
    restart: unless-stopped
    environment:
      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD:-change-me-in-prod}
      MARIADB_DATABASE: {{projectNameSnake}}
      MARIADB_USER: app
      MARIADB_PASSWORD: ${MARIADB_PASSWORD:-app}
    ports:
      - "3308:3306"
    command:
      - "--log-bin=mysql-bin"
      - "--binlog-format=ROW"
      - "--binlog-row-image=FULL"
      - "--server-id=1"
      - "--binlog-expire-logs-seconds=86400"
    volumes:
      - {{projectName}}-prod-mariadbdata:/var/lib/mysql
      - ./docker/mariadb-init.sql:/docker-entrypoint-initdb.d/10-replication.sql:ro
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 5s
      timeout: 3s
      retries: 20

  minio:
    image: minio/minio
    container_name: {{projectName}}-minio-prod
    restart: unless-stopped
    environment:
      MINIO_ROOT_USER: ${S3_ACCESS_KEY_ID:-minioadmin}
      MINIO_ROOT_PASSWORD: ${S3_SECRET_ACCESS_KEY:-minioadmin}
    command: server /data --console-address ":9001"
    volumes:
      - {{projectName}}-prod-miniodata:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 5s
      timeout: 3s
      retries: 20

  api:
    build:
      context: ./
      dockerfile: docker/api.Dockerfile
      target: prod
      args:
        APP_PATH: apps/{{projectName}}/api
    image: {{projectName}}-api:latest
    container_name: {{projectName}}-api
    restart: unless-stopped
    environment:
      NODE_ENV: production
      DB_DIALECT: mariadb
      DB_URL: mysql://app:${MARIADB_PASSWORD:-app}@mariadb:3306/{{projectNameSnake}}
      CDC: "1"
      STORAGE_PROVIDER: minio
      S3_ENDPOINT: http://minio:9000
      S3_BUCKET: {{projectNameSnake}}
      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-minioadmin}
      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-minioadmin}
      S3_FORCE_PATH_STYLE: "1"
      VOLTRO_SESSION_SECRET: ${VOLTRO_SESSION_SECRET:?must be set for prod compose}
      # Only needed once an app turns on a plugin that encrypts columns at rest
      # (`governance` with `fieldEncryption`, or any `.encrypted()` column). It
      # is commented out because a generated file cannot know which plugins you
      # will enable — and left here, named, because the alternative is finding
      # out at `onActivate` in a container:
      #
      #   governance: fieldEncryption is enabled but secret
      #   "VOLTRO_FIELD_ENCRYPTION_KEY" did not resolve
      #
      # Mint it with `voltro secret generate field-encryption` — same shape as
      # `openssl rand -hex 32`, but it is the documented path and it cannot
      # produce the wrong length. LOSE THE KEY, LOSE THE DATA: there is no
      # recovery for a column encrypted under a key you no longer have, so back
      # it up wherever you keep the session secret.
      # VOLTRO_FIELD_ENCRYPTION_KEY: ${VOLTRO_FIELD_ENCRYPTION_KEY:?must be set once fieldEncryption is on}
    ports:
      - "4000:4000"
    depends_on:
      mariadb:
        condition: service_healthy
      minio:
        condition: service_healthy

  web:
    build:
      context: ./
      dockerfile: docker/web.Dockerfile
      target: prod
      args:
        APP_PATH: apps/{{projectName}}/web
        APP_PORT: "5173"
    image: {{projectName}}-web:latest
    container_name: {{projectName}}-web
    restart: unless-stopped
    environment:
      NODE_ENV: production
    ports:
      - "5173:5173"
    depends_on:
      - api

volumes:
  {{projectName}}-prod-mariadbdata:
  {{projectName}}-prod-miniodata: