docker-compose.yml

services:
  gateway:
    image: nginx:1.27-alpine
    container_name: lexilingo-gateway
    restart: unless-stopped
    depends_on:
      backend-service:
        condition: service_started
      ai-service:
        condition: service_started
    environment:
      GATEWAY_SERVER_NAME: ${GATEWAY_SERVER_NAME:-api.lexilingo.me}
      GATEWAY_SSL_CERT_PATH: ${GATEWAY_SSL_CERT_PATH:-/etc/letsencrypt/live/api.lexilingo.me/fullchain.pem}
      GATEWAY_SSL_KEY_PATH: ${GATEWAY_SSL_KEY_PATH:-/etc/letsencrypt/live/api.lexilingo.me/privkey.pem}
    command: >
      /bin/sh -c "envsubst '$$GATEWAY_SERVER_NAME $$GATEWAY_SSL_CERT_PATH $$GATEWAY_SSL_KEY_PATH'
      < /etc/nginx/templates/default.conf.template
      > /etc/nginx/conf.d/default.conf
      && nginx -g 'daemon off;'"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./gateway/nginx/templates:/etc/nginx/templates:ro
      - ./gateway/nginx/snippets:/etc/nginx/snippets:ro
      - ./gateway/nginx/acme-challenge:/var/www/certbot
      - ./gateway/nginx/logs:/var/log/nginx
      - /etc/letsencrypt:/etc/letsencrypt:ro
    healthcheck:
      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 15s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    networks:
      - lexilingo-prod

  postgres:
    image: postgres:16-alpine
    container_name: lexilingo-postgres
    restart: unless-stopped
    command: postgres -c shared_buffers=128MB -c work_mem=4MB -c max_connections=100
    deploy:
      resources:
        limits:
          memory: 512M
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-lexilingo}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set in .env.production.secrets}
      POSTGRES_DB: ${POSTGRES_DB:-lexilingo}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "127.0.0.1:5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - lexilingo-prod

  mongodb:
    image: mongo:7.0
    container_name: lexilingo-mongodb
    restart: unless-stopped
    command: mongod --wiredTigerCacheSizeGB 0.25
    deploy:
      resources:
        limits:
          memory: 512M
    environment:
      MONGO_INITDB_DATABASE: ${MONGODB_DATABASE:-lexilingo}
    volumes:
      - mongodb_data:/data/db
      - mongodb_config:/data/configdb
    healthcheck:
      test: ["CMD", "mongosh", "--quiet", "--eval", "db.adminCommand('ping').ok"]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 30s
    networks:
      - lexilingo-prod

  redis:
    image: redis:7-alpine
    container_name: lexilingo-redis
    restart: unless-stopped
    environment:
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set in .env.production.secrets}
    command: /bin/sh -c 'redis-server --appendonly yes --maxmemory 512mb --maxmemory-policy allkeys-lru --requirepass "$$REDIS_PASSWORD"'
    volumes:
      - redis_data:/data
    ports:
      - "127.0.0.1:6379:6379"
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a \"$$REDIS_PASSWORD\" ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - lexilingo-prod

  backend-service:
    build:
      context: ./backend-service
      dockerfile: Dockerfile.prod
    # TIP: To run multiple replicas for load balancing, remove `container_name`
    # and run: docker-compose up --scale backend-service=2
    # Nginx's `least_conn` upstream will automatically distribute traffic
    # across all replicas via Docker's internal DNS round-robin.
    container_name: lexilingo-backend-service
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 1G
        reservations:
          cpus: "0.25"
          memory: 256M
    env_file:
      - .env.production
      - .env.production.secrets
    environment:
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-lexilingo}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}@postgres:5432/${POSTGRES_DB:-lexilingo}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD must be set}@redis:6379/0
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
      AI_SERVICE_URL: http://ai-service:8001/api/v1
      CONTENT_AGENT_ENABLED: ${CONTENT_AGENT_ENABLED:-false}
      CONTENT_AGENT_SERVICE_TOKEN: ${CONTENT_AGENT_SERVICE_TOKEN:-}
      LEXILINGO_PARTNER_API_KEY_HASHES: ${LEXILINGO_PARTNER_API_KEY_HASHES:-}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    expose:
      - "8000"
    volumes:
      - ./backend-service/firebase-service-account.json:/run/secrets/firebase-service-account.json:ro
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=3)\""]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 60s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    networks:
      - lexilingo-prod

  backend-reminder-worker:
    build:
      context: ./backend-service
      dockerfile: Dockerfile.prod
    container_name: lexilingo-reminder-worker
    restart: unless-stopped
    command: celery -A app.core.celery_app:celery_app worker --loglevel=INFO --concurrency=1
    env_file:
      - .env.production
      - .env.production.secrets
    environment:
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-lexilingo}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}@postgres:5432/${POSTGRES_DB:-lexilingo}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD must be set}@redis:6379/0
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
      SECRET_KEY: ${SECRET_KEY:?Set SECRET_KEY in .env}
      DEBUG: ${DEBUG:-False}
      AI_SERVICE_URL: http://ai-service:8001/api/v1
      CONTENT_AGENT_ENABLED: ${CONTENT_AGENT_ENABLED:-false}
      CONTENT_AGENT_SERVICE_TOKEN: ${CONTENT_AGENT_SERVICE_TOKEN:-}
      REMINDERS_ENABLED: ${REMINDERS_ENABLED:-false}
      REMINDER_DRY_RUN: ${REMINDER_DRY_RUN:-true}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - ./backend-service/firebase-service-account.json:/run/secrets/firebase-service-account.json:ro
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    networks:
      - lexilingo-prod
    healthcheck:
      disable: true

  backend-reminder-beat:
    build:
      context: ./backend-service
      dockerfile: Dockerfile.prod
    container_name: lexilingo-reminder-beat
    restart: unless-stopped
    command: celery -A app.core.celery_app:celery_app beat --loglevel=INFO
    env_file:
      - .env.production
      - .env.production.secrets
    environment:
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-lexilingo}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}@postgres:5432/${POSTGRES_DB:-lexilingo}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD must be set}@redis:6379/0
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
      REMINDERS_ENABLED: ${REMINDERS_ENABLED:-false}
      REMINDER_DRY_RUN: ${REMINDER_DRY_RUN:-true}
    depends_on:
      redis:
        condition: service_healthy
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    networks:
      - lexilingo-prod
    healthcheck:
      disable: true

  ai-service:
    build:
      context: ./ai-service
      dockerfile: Dockerfile.prod
    container_name: lexilingo-ai-service
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "2.0"
          memory: 2G
        reservations:
          cpus: "0.5"
          memory: 512M
    env_file:
      - .env.production
      - .env.production.secrets
    environment:
      ENVIRONMENT: production
      MONGODB_URI: mongodb://mongodb:27017
      MONGODB_DATABASE: ${MONGODB_DATABASE:-lexilingo}
      REDIS_URL: redis://:${REDIS_PASSWORD:?REDIS_PASSWORD must be set}@redis:6379/1
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
      REDIS_DB: 1
      AI_MODEL_API_URL: http://ai-service:8001
      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-http://host.docker.internal:11434}
      GEMINI_API_KEY: ${GEMINI_API_KEY}
      GROQ_API_KEYS: ${GROQ_API_KEYS:?Set exactly seven Groq keys}
      GROQ_REQUIRE_SEVEN_KEYS: "true"
      GROQ_MODEL: ${GROQ_MODEL:-llama-3.1-8b-instant}
      GROQ_SLOT_TELEMETRY: ${GROQ_SLOT_TELEMETRY:-false}
      TRACECAG_GROQ_RPM: ${TRACECAG_GROQ_RPM:-28}
      REDIS_MAX_CONNECTIONS: ${REDIS_MAX_CONNECTIONS:-50}
      ALLOWED_ORIGINS: ${ALLOWED_ORIGINS:?Set ALLOWED_ORIGINS in .env}
      DEBUG: ${DEBUG:-false}
      VOICE_DUPLEX_ENABLED: ${VOICE_DUPLEX_ENABLED:-false}
      TTS_MODEL_PATH: ${TTS_MODEL_PATH:-/opt/voice-models/piper/en_US-lessac-medium.onnx}
      TTS_CONFIG_PATH: ${TTS_CONFIG_PATH:-/opt/voice-models/piper/en_US-lessac-medium.onnx.json}
      TTS_INTRA_OP_THREADS: ${TTS_INTRA_OP_THREADS:-4}
      CONTENT_AGENT_SERVICE_TOKEN: ${CONTENT_AGENT_SERVICE_TOKEN:-}
      CONTENT_AGENT_TTL_SECONDS: ${CONTENT_AGENT_TTL_SECONDS:-3600}
      CONTENT_AGENT_MAX_RECORDS: ${CONTENT_AGENT_MAX_RECORDS:-20000}
      CONTENT_AGENT_MAX_BATCH_RECORDS: ${CONTENT_AGENT_MAX_BATCH_RECORDS:-2000}
      CONTENT_AGENT_ALLOW_LOCAL_STORE: ${CONTENT_AGENT_ALLOW_LOCAL_STORE:-true}
    depends_on:
      mongodb:
        condition: service_healthy
      redis:
        condition: service_healthy
    expose:
      - "8001"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - ai_models:/app/models
      - ./ai-service/data:/app/data
      - ./backend-service/data/media:/app/data/media:ro
      - content_etl_data:/data/content-etl
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:8001/health', timeout=3)\""]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 90s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    networks:
      - lexilingo-prod

  # ============================================
  # Prometheus — metrics scraper
  # ============================================
  prometheus:
    image: prom/prometheus:v2.53.2
    container_name: lexilingo-prometheus
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M
    ports:
      - "127.0.0.1:9090:9090"
    volumes:
      - ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - ./monitoring/rules:/etc/prometheus/rules:ro
      - prometheus_data:/prometheus
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
      - "--storage.tsdb.retention.time=15d"
      - "--web.enable-lifecycle"
    networks:
      - lexilingo-prod

  # ============================================
  # Grafana — metrics dashboard
  # ============================================
  grafana:
    image: grafana/grafana:11.2.0
    container_name: lexilingo-grafana
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M
    ports:
      - "127.0.0.1:3001:3000"
    environment:
      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?Set GRAFANA_ADMIN_PASSWORD in .env}
      GF_USERS_ALLOW_SIGN_UP: "false"
      GF_SERVER_ROOT_URL: ${GRAFANA_ROOT_URL:-http://localhost:3001}
    volumes:
      - grafana_data:/var/lib/grafana
      - ./monitoring/grafana/provisioning:/etc/grafana/provisioning:ro
    depends_on:
      - prometheus
    networks:
      - lexilingo-prod

volumes:
  postgres_data:
  mongodb_data:
  mongodb_config:
  redis_data:
  ai_models:
    driver: local
  redis_ai_data:
    driver: local
  prometheus_data:
    driver: local
  grafana_data:
    driver: local
  content_etl_data:
    driver: local

networks:
  lexilingo-prod:
    driver: bridge