docker-compose.prod.yml

# ===========================================
# SPOOLED BACKEND - PRODUCTION DEPLOYMENT
# ===========================================
#
# Production host (shared machine): compose project name must be exactly
#   `spooled-backend`. Preferred rollout is Portainer Git → Pull and redeploy
#   with BACKEND_IMAGE defaulting to :latest. Never run this compose project
#   against unrelated apps on a shared Docker host.
#
# Operator guide: docs/guides/production-host-portainer.md
#
# Deploy via Portainer, Docker Compose, or any container orchestrator.
# Images are automatically built by GitHub Actions for amd64 and arm64.
#
# Includes: Backend API, PostgreSQL, Redis, Prometheus, Grafana, Cloudflare Tunnel
#
# Zero-touch init (anybody can deploy):
#   - gRPC TLS cert auto-generated into volume `grpc_tls` (helper stays Up/healthy)
#   - Prometheus + Grafana self-bootstrap scrape/datasource config on start
#   - No busybox one-shot Exited (0) containers; single-file curl of this compose works
#   - Optional richer local assets: docker/prometheus, docker/grafana (dev compose)
#
# Quick start:
#   1. Copy .env.example to .env and configure
#   2. docker compose -f docker-compose.prod.yml up -d
#
# For Portainer (preferred on prod host):
#   Git stack → repository Spooled-Cloud/spooled-backend → this file at repo root
#   → BACKEND_IMAGE defaults to :latest (intentional for Pull and redeploy).
#   → set BACKEND_IMAGE only for temporary rollback to a tag/digest.
#   Git stacks do not show the Web Editor tab (normal). See operator guide.
#
# Required Environment Variables:
#   POSTGRES_PASSWORD       - Database password
#   JWT_SECRET              - 32+ character secret for JWT signing
#   CLOUDFLARE_TUNNEL_TOKEN - Cloudflare tunnel token (for cloudflared)
#
# gRPC TLS:
#   A private self-signed origin certificate is generated automatically and persisted
#   in a Docker volume. No certificate files or environment variables are required.
#   For Cloudflare Tunnel, use an HTTPS service to backend:50051 with HTTP/2 origin
#   enabled and TLS verification disabled for the self-signed origin certificate.
#
# Registration Mode (for SaaS vs Self-hosted):
#   REGISTRATION_MODE    - "open" (default, anyone can create orgs)
#                        - "closed" (only admin can create orgs - for SaaS)
#   ADMIN_API_KEY        - Secret key for creating orgs when mode is "closed"
#
# Email Configuration:
#   EMAIL_PROVIDER       - console, resend, sendgrid, postmark, smtp
#   EMAIL_API_KEY        - API key for the email provider
#   EMAIL_FROM_ADDRESS   - From email address
#   EMAIL_FROM_NAME      - From name
#
# Stripe Billing (optional):
#   STRIPE_SECRET_KEY            - Stripe secret key
#   STRIPE_BILLING_WEBHOOK_SECRET - Stripe webhook secret
#   STRIPE_STARTER_PRICE_ID      - Starter plan price ID
#   STRIPE_PRO_PRICE_ID          - Pro plan price ID
#
# Optional Environment Variables:
#   BACKEND_IMAGE        - Docker image (default: ghcr.io/spooled-cloud/spooled-backend:latest)
#                          Production Portainer workflow follows :latest on purpose.
#   REDIS_PASSWORD       - Redis password (recommended for production)
#   GRAFANA_USER         - Grafana admin username (default: admin)
#   GRAFANA_PASSWORD     - Grafana admin password (default: admin) - CHANGE THIS!
#   GRAFANA_URL          - Grafana public URL (e.g., https://grafana.spooled.cloud)
#
# Cloudflare Tunnel Routes (configure in Zero Trust dashboard):
#   - api.spooled.cloud     -> http://backend:8080
#   - grpc.spooled.cloud    -> https://backend:50051 (HTTP/2 origin ON, No TLS Verify ON)
#   - grafana.spooled.cloud -> http://grafana:3000
#
# Note: the old image-baked self-signed gRPC key is compromised and must not be reused.

services:
  # ===========================================
  # PostgreSQL Database
  # ===========================================
  db:
    image: postgres:16-alpine
    container_name: spooled_db
    # Loopback-only publish so an SSH tunnel has a stable target
    # (container IPs are Docker-assigned and move between redeploys).
    # NOT reachable off-host: bound to 127.0.0.1, never 0.0.0.0.
    ports:
      - "127.0.0.1:5432:5432"
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-spooled}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB:-spooled}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=en_US.UTF-8"
    volumes:
      - db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-spooled}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - spooled-network

  # ===========================================
  # Redis Cache & Pub/Sub
  # ===========================================
  redis:
    image: redis:7-alpine
    container_name: spooled_redis
    restart: unless-stopped
    command: redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - spooled-network

  # Generates a private origin certificate on first deploy and renews it when less
  # than 30 days remain. The key stays in the Docker volume and is never in Git or
  # an image. Works with full Git/Portainer clones and a single-file compose download
  # — no host PEM upload and no Exited (0) busybox one-shot.
  #
  # After ensuring certs, stays healthy (`tail -f`) so Portainer looks clean.
  # For one-shot CI checks set GRPC_TLS_INIT_ONCE=1 (exits 0 after write).
  grpc-tls-init:
    image: alpine/openssl:3.5.7
    # No fixed container_name: allows `compose run --rm` in CI alongside any
    # already-running stack. Portainer still shows the compose service name.
    user: root
    restart: unless-stopped
    environment:
      GRPC_TLS_INIT_ONCE: ${GRPC_TLS_INIT_ONCE:-0}
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        umask 077
        if [ ! -s /tls/grpc-cert.pem ] || [ ! -s /tls/grpc-key.pem ] || ! openssl x509 -checkend 2592000 -noout -in /tls/grpc-cert.pem >/dev/null 2>&1; then
          openssl req -x509 -newkey rsa:2048 -sha256 -nodes \
            -keyout /tls/grpc-key.pem.new \
            -out /tls/grpc-cert.pem.new \
            -days 397 \
            -subj "/CN=backend" \
            -addext "subjectAltName=DNS:backend"
          mv /tls/grpc-key.pem.new /tls/grpc-key.pem
          mv /tls/grpc-cert.pem.new /tls/grpc-cert.pem
        fi
        chown 1000:1000 /tls/grpc-cert.pem /tls/grpc-key.pem
        chmod 0444 /tls/grpc-cert.pem
        chmod 0400 /tls/grpc-key.pem
        if [ "$${GRPC_TLS_INIT_ONCE:-0}" = "1" ]; then
          exit 0
        fi
        exec tail -f /dev/null
    volumes:
      - grpc_tls:/tls
    healthcheck:
      test: ["CMD", "test", "-s", "/tls/grpc-cert.pem"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

  # ===========================================
  # Spooled Backend API
  # ===========================================
  backend:
    image: ${BACKEND_IMAGE:-ghcr.io/spooled-cloud/spooled-backend:latest}
    pull_policy: always
    # platform: linux/arm64  # Uncomment if you need to force ARM64
    container_name: spooled_backend
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      grpc-tls-init:
        condition: service_healthy
    environment:
      # =====================
      # Database
      # =====================
      DATABASE_URL: postgres://${POSTGRES_USER:-spooled}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-spooled}
      DATABASE_MAX_CONNECTIONS: ${DATABASE_MAX_CONNECTIONS:-25}
      DATABASE_MIN_CONNECTIONS: ${DATABASE_MIN_CONNECTIONS:-5}
      DATABASE_ACQUIRE_TIMEOUT_SECS: ${DATABASE_ACQUIRE_TIMEOUT_SECS:-30}
      
      # =====================
      # Redis
      # =====================
      REDIS_URL: redis://redis:6379
      REDIS_POOL_SIZE: ${REDIS_POOL_SIZE:-10}
      
      # =====================
      # Server
      # =====================
      HOST: 0.0.0.0
      PORT: 8080
      METRICS_PORT: 9090
      RUST_ENV: ${RUST_ENV:-production}
      RUST_LOG: ${RUST_LOG:-info,tower_http=info}
      JSON_LOGS: ${JSON_LOGS:-true}
      
      # =====================
      # Security
      # =====================
      JWT_SECRET: ${JWT_SECRET}
      JWT_EXPIRATION_HOURS: ${JWT_EXPIRATION_HOURS:-24}
      
      # =====================
      # gRPC origin TLS
      # Certificate/key are generated into a private volume, never image contents.
      # =====================
      GRPC_TLS_ENABLED: "true"
      GRPC_TLS_CERT_PATH: /run/secrets/grpc-cert.pem
      GRPC_TLS_KEY_PATH: /run/secrets/grpc-key.pem
      
      # =====================
      # Rate Limiting
      # =====================
      RATE_LIMIT_REQUESTS_PER_SECOND: ${RATE_LIMIT_REQUESTS_PER_SECOND:-100}
      RATE_LIMIT_BURST_SIZE: ${RATE_LIMIT_BURST_SIZE:-200}
      
      # =====================
      # Queue Settings
      # =====================
      QUEUE_DEFAULT_MAX_RETRIES: ${QUEUE_DEFAULT_MAX_RETRIES:-3}
      QUEUE_DEFAULT_TIMEOUT_SECS: ${QUEUE_DEFAULT_TIMEOUT_SECS:-300}
      QUEUE_MAX_PAYLOAD_SIZE_BYTES: ${QUEUE_MAX_PAYLOAD_SIZE_BYTES:-1048576}
      
      # =====================
      # Worker Settings
      # =====================
      WORKER_HEARTBEAT_INTERVAL_SECS: ${WORKER_HEARTBEAT_INTERVAL_SECS:-10}
      WORKER_LEASE_DURATION_SECS: ${WORKER_LEASE_DURATION_SECS:-30}
      WORKER_MAX_CONCURRENCY: ${WORKER_MAX_CONCURRENCY:-5}
      WORKER_FALLBACK_POLL_INTERVAL_SECS: ${WORKER_FALLBACK_POLL_INTERVAL_SECS:-5}
      
      # =====================
      # Registration / Auth
      # =====================
      REGISTRATION_MODE: ${REGISTRATION_MODE:-open}
      EMAIL_SIGNUP_ENABLED: ${EMAIL_SIGNUP_ENABLED:-true}
      ADMIN_API_KEY: ${ADMIN_API_KEY:-}
      
      # =====================
      # Email
      # =====================
      EMAIL_PROVIDER: ${EMAIL_PROVIDER:-console}
      EMAIL_API_KEY: ${EMAIL_API_KEY:-}
      EMAIL_FROM_ADDRESS: ${EMAIL_FROM_ADDRESS:-noreply@spooled.cloud}
      EMAIL_FROM_NAME: ${EMAIL_FROM_NAME:-Spooled Cloud}
      SMTP_HOST: ${SMTP_HOST:-}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME:-}
      SMTP_PASSWORD: ${SMTP_PASSWORD:-}
      
      # =====================
      # Stripe Billing
      # =====================
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
      STRIPE_BILLING_WEBHOOK_SECRET: ${STRIPE_BILLING_WEBHOOK_SECRET:-}
      STRIPE_STARTER_PRICE_ID: ${STRIPE_STARTER_PRICE_ID:-}
      STRIPE_PRO_PRICE_ID: ${STRIPE_PRO_PRICE_ID:-}
      STRIPE_BILLING_PORTAL_CONFIG_ID: ${STRIPE_BILLING_PORTAL_CONFIG_ID:-}
      
      # =====================
      # Webhooks
      # =====================
      GITHUB_WEBHOOK_SECRET: ${GITHUB_WEBHOOK_SECRET:-}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
      
      # =====================
      # OpenTelemetry
      # =====================
      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
      OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-spooled-backend}
      
      # =====================
      # Metrics
      # =====================
      METRICS_TOKEN: ${METRICS_TOKEN:-}

    volumes:
      - grpc_tls:/run/secrets:ro
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    networks:
      - spooled-network

  # ===========================================
  # Cloudflare Tunnel (Zero Trust Access)
  # ===========================================
  # Routes traffic to backend without exposing ports
  # Configure routes in Cloudflare Zero Trust dashboard:
  #   - api.yourdomain.com -> http://backend:8080
  #   - grpc.yourdomain.com -> https://backend:50051 (HTTP2 origin ON, No TLS Verify ON)
  cloudflared:
    image: cloudflare/cloudflared:latest
    container_name: spooled_cloudflared
    restart: unless-stopped
    command: --protocol http2 tunnel --no-autoupdate run --token ${CLOUDFLARE_TUNNEL_TOKEN}
    depends_on:
      - backend
    networks:
      - spooled-network

  # ===========================================
  # Prometheus (Metrics Collection)
  # ===========================================
  # Self-bootstraps scrape config on start (no extra busybox init container, no
  # bind-mount from the repo). A single downloaded compose file still works.
  # Richer local/dev rules live under docker/prometheus/ for `docker compose` (dev).
  prometheus:
    image: prom/prometheus:v2.48.0
    container_name: spooled_prometheus
    restart: unless-stopped
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        cat > /tmp/prometheus.yml <<'EOF'
        global:
          scrape_interval: 15s
          evaluation_interval: 15s
          external_labels:
            cluster: spooled
            environment: production
        scrape_configs:
          - job_name: spooled-backend
            static_configs:
              - targets: ["backend:9090"]
            metrics_path: /metrics
            scrape_interval: 10s
          - job_name: prometheus
            static_configs:
              - targets: ["localhost:9090"]
        EOF
        exec /bin/prometheus \
          --config.file=/tmp/prometheus.yml \
          --storage.tsdb.path=/prometheus \
          --storage.tsdb.retention.time=15d \
          --web.enable-lifecycle
    volumes:
      - prometheus_data:/prometheus
    networks:
      - spooled-network
    depends_on:
      - backend
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:9090/-/healthy"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ===========================================
  # Grafana (Dashboards & Visualization)
  # ===========================================
  # Self-bootstraps Prometheus datasource provisioning on start (no busybox init).
  # Optional richer dashboards for local/dev: docker/grafana/ under repo root.
  grafana:
    image: grafana/grafana:10.2.2
    container_name: spooled_grafana
    restart: unless-stopped
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_PASSWORD:-admin}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_SERVER_ROOT_URL: ${GRAFANA_URL:-http://localhost:3000}
      GF_PATHS_PROVISIONING: /var/lib/grafana/provisioning
      GF_DATASOURCES_DEFAULT_NAME: Prometheus
    entrypoint: ["/bin/sh", "-ec"]
    command:
      - |
        mkdir -p /var/lib/grafana/provisioning/datasources \
                 /var/lib/grafana/provisioning/dashboards \
                 /var/lib/grafana/dashboards
        cat > /var/lib/grafana/provisioning/datasources/prometheus.yml <<'EOF'
        apiVersion: 1
        datasources:
          - name: Prometheus
            type: prometheus
            access: proxy
            url: http://prometheus:9090
            isDefault: true
            editable: false
        EOF
        cat > /var/lib/grafana/provisioning/dashboards/default.yml <<'EOF'
        apiVersion: 1
        providers:
          - name: Spooled
            orgId: 1
            folder: ""
            type: file
            disableDeletion: false
            updateIntervalSeconds: 30
            options:
              path: /var/lib/grafana/dashboards
        EOF
        exec /run.sh
    volumes:
      - grafana_data:/var/lib/grafana
    networks:
      - spooled-network
    depends_on:
      - prometheus
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  # ===========================================
  # pgAdmin (Optional - Database Admin)
  # ===========================================
  # Expose via Cloudflare tunnel when needed (e.g., db.yourdomain.com)
  pgadmin:
    image: dpage/pgadmin4:latest
    container_name: spooled_pgadmin
    restart: unless-stopped
    profiles: ["admin"]
    environment:
      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL:-admin@spooled.cloud}
      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD:-admin}
      PGADMIN_CONFIG_SERVER_MODE: "False"
      PGADMIN_CONFIG_MASTER_PASSWORD_REQUIRED: "False"
    volumes:
      - pgadmin_data:/var/lib/pgadmin
    depends_on:
      - db
    networks:
      - spooled-network

# ===========================================
# Volumes
# ===========================================
volumes:
  db_data:
    driver: local
  redis_data:
    driver: local
  grpc_tls:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local
  pgadmin_data:
    driver: local

# ===========================================
# Networks
# ===========================================
networks:
  spooled-network:
    driver: bridge