compose.prod.yaml

x-logging: &default-logging
  driver: 'json-file'
  options:
    max-size: "50m"
    max-file: 6
x-network: &default-network
  internal:
x-base: &base
  depends_on:
    pgsql:
      condition: service_healthy
    valkey:
      condition: service_healthy
    ssr:
      condition: service_healthy
  image: ${IMAGE_NAME:-app}:latest
  env_file:
    - .env.production
  ulimits:
    nofile:
      soft: 20000
      hard: 40000
  security_opt:
    - no-new-privileges:true
  volumes:
    - 'storage_public:/var/www/html/storage/app/public'
    - 'storage_logs:/var/www/html/storage/logs'
    - 'storage_templates:/var/www/html/storage/app/generated-templates'
  logging: *default-logging
  restart: always

services:
  app:
    <<: *base
    build:
      target: app
    command: ["php", "/var/www/html/artisan", "octane:start", "--server=frankenphp", "--port=8080"]
    stop_signal: SIGTERM
    environment:
      AUTORUN_ENABLED: true
      INERTIA_SSR_URL: http://ssr:13714
      INERTIA_SSR_ENSURE_BUNDLE_EXISTS: false
      PHP_OPCACHE_ENABLE: "1"
    networks:
      - internal
      - proxy
    healthcheck:
      test: ["CMD", "healthcheck-octane"]
      start_period: 10s
    labels:
      traefik.enable: true
      traefik.http.routers.fadogen.rule: Host(`${APP_HOST}`)
#      traefik.http.routers.fadogen.entrypoints: websecure
#      traefik.http.routers.fadogen.tls: true
#      traefik.http.routers.fadogen.tls.certresolver: letsencrypt-digitalocean
      traefik.http.services.fadogen.loadbalancer.server.port: 8080
      # Health check
      traefik.http.services.fadogen.loadbalancer.healthcheck.path: "/up"
      traefik.http.services.fadogen.loadbalancer.healthcheck.interval: "30s"
      traefik.http.services.fadogen.loadbalancer.healthcheck.timeout: "5s"
      traefik.http.services.fadogen.loadbalancer.healthcheck.scheme: "http"

  horizon:
    <<: *base
    command: ["php", "/var/www/html/artisan", "horizon"]
    stop_signal: SIGTERM
    networks: *default-network
    depends_on:
      app:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "healthcheck-horizon"]
      start_period: 10s

  scheduler:
    <<: *base
    command: ["php", "/var/www/html/artisan", "schedule:work"]
    stop_signal: SIGTERM
    networks: *default-network
    depends_on:
      app:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "healthcheck-schedule"]
      start_period: 10s

#  reverb:
#    <<: *base
#    command: ["php", "/var/www/html/artisan", "reverb:start", "--port=8080"]
#    stop_signal: SIGTERM
#    networks: *default-network
#    depends_on:
#      app:
#        condition: service_healthy
#    healthcheck:
#      test: ["CMD", "healthcheck-reverb"]
#      start_period: 10s

  ssr:
    image: ${IMAGE_NAME:-app}:ssr
    build:
      target: ssr
    security_opt:
      - no-new-privileges:true
    networks: *default-network
    logging: *default-logging
    restart: always
    healthcheck:
      test: ["CMD", "bun", "-e", "fetch('http://localhost:13714/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
      start_period: 5s
      interval: 30s
      timeout: 10s
      retries: 3

  valkey:
    image: 'valkey/valkey:alpine'
    ulimits:
      nofile:
        soft: 20000
        hard: 40000
    command: [ "valkey-server", "--requirepass", "${REDIS_PASSWORD}", "--maxmemory", "2gb" ]
    security_opt:
      - no-new-privileges:true
    environment:
      REDIS_PASSWORD: "${REDIS_PASSWORD}"
    volumes:
      - 'stack-valkey:/data'
      - 'backup_dumps:/dumps'
    logging: *default-logging
    networks: *default-network
    healthcheck:
      test: [ "CMD", "valkey-cli", "-a", "${REDIS_PASSWORD}", "ping" ]
      retries: 3
      timeout: 5s
    labels:
      - docker-volume-backup.archive-pre=/bin/sh -c 'valkey-cli -a $$REDIS_PASSWORD BGSAVE && sleep 2 && cp /data/dump.rdb /dumps/valkey.rdb'
    restart: always

  pgsql:
    image: 'postgres:18'
    ulimits:
      nofile:
        soft: 20000
        hard: 40000
    security_opt:
      - no-new-privileges:true
    environment:
      PGPASSWORD: '${DB_PASSWORD}'
      POSTGRES_DB: '${DB_DATABASE}'
      POSTGRES_USER: '${DB_USERNAME}'
      POSTGRES_PASSWORD: '${DB_PASSWORD}'
    volumes:
      - 'stack-pgsql:/var/lib/postgresql'
      - 'backup_dumps:/dumps'
    networks: *default-network
    healthcheck:
      test: [ "CMD", "pg_isready", "-q", "-d", "${DB_DATABASE}", "-U", "${DB_USERNAME}"]
      interval: 15s
      retries: 12
      timeout: 20s
    labels:
      - docker-volume-backup.archive-pre=/bin/sh -c 'pg_dump -U $$POSTGRES_USER -d $$POSTGRES_DB -F c -f /dumps/pgsql.dump'
    restart: always

  backup:
    image: offen/docker-volume-backup:v2
    security_opt:
      - no-new-privileges:true
    environment:
      AWS_S3_BUCKET_NAME: "${BACKUP_S3_BUCKET}"
      AWS_S3_PATH: "${BACKUP_S3_PATH}"
      AWS_ACCESS_KEY_ID: "${BACKUP_AWS_ACCESS_KEY_ID}"
      AWS_SECRET_ACCESS_KEY: "${BACKUP_AWS_SECRET_ACCESS_KEY}"
      AWS_ENDPOINT: "${BACKUP_AWS_ENDPOINT}"
      BACKUP_CRON_EXPRESSION: "0 3 * * *"
      BACKUP_RETENTION_DAYS: "${BACKUP_RETENTION_DAYS:-7}"
    volumes:
      - backup_dumps:/backup/dumps:ro
      - storage_logs:/backup/logs:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks: *default-network
    logging: *default-logging
    restart: always

networks:
  internal:
  proxy:
    external: true

volumes:
  storage_public:
  storage_logs:
  storage_templates:
  stack-pgsql:
  stack-valkey:
  backup_dumps: