---
# Stack: tracearr
#
# But:
# - Deployer Tracearr avec TimescaleDB et Redis
# - Eviter les mots de passe en clair dans Git
# - Stocker les secrets dans /opt/stacks/tracearr/secrets
#
# Notes:
# - Le fichier .env de production n est pas utilise
# - Les secrets sont lus depuis des fichiers Docker secrets

services:
  tracearr:
    image: ghcr.io/connorgallopo/tracearr:latest
    container_name: tracearr
    restart: unless-stopped

    depends_on:
      timescale:
        condition: service_healthy
      redis:
        condition: service_healthy

    ports:
      - "3000:3000"

    environment:
      NODE_ENV: production
      PORT: "3000"
      HOST: 0.0.0.0
      TZ: Europe/Paris
      DATABASE_URL_FILE: /run/secrets/database_url
      REDIS_URL: redis://redis:6379
      JWT_SECRET_FILE: /run/secrets/jwt_secret
      COOKIE_SECRET_FILE: /run/secrets/cookie_secret
      BETTER_AUTH_SECRET_FILE: /run/secrets/better_auth_secret
      CORS_ORIGIN: https://tracearr.thomasmlg.fr
      LOG_LEVEL: info

    secrets:
      - database_url
      - jwt_secret
      - cookie_secret
      - better_auth_secret

    volumes:
      - tracearr_backups:/data/backup

    networks:
      - tracearr_network

  timescale:
    image: timescale/timescaledb-ha:pg18.1-ts2.25.0
    container_name: tracearr-db
    restart: unless-stopped
    shm_size: 512mb

    ulimits:
      nofile:
        soft: 65536
        hard: 65536

    command: >
      postgres
      -c timescaledb.license=timescale
      -c timescaledb.max_tuples_decompressed_per_dml_transaction=0
      -c max_locks_per_transaction=4096
      -c timescaledb.telemetry_level=off

    environment:
      POSTGRES_USER: tracearr
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
      POSTGRES_DB: tracearr

    secrets:
      - db_password

    volumes:
      - timescale_data:/home/postgres/pgdata/data

    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U tracearr"]
      interval: 10s
      timeout: 5s
      retries: 5

    networks:
      - tracearr_network

  redis:
    image: redis:8-alpine
    container_name: tracearr-redis
    restart: unless-stopped
    command: redis-server --appendonly yes

    volumes:
      - redis_data:/data

    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

    networks:
      - tracearr_network

secrets:
  db_password:
    file: ./secrets/db_password
  database_url:
    file: ./secrets/database_url
  jwt_secret:
    file: ./secrets/jwt_secret
  cookie_secret:
    file: ./secrets/cookie_secret
  better_auth_secret:
    file: ./secrets/better_auth_secret

networks:
  tracearr_network:
    driver: bridge

volumes:
  tracearr_backups:
  timescale_data:
  redis_data: