docker-compose.prod.yml

# =============================================================================
# Production Docker Compose with Traefik
# =============================================================================
#
# Architecture:
#   Internet → Traefik (SSL/LB) → Services (webapp, rest-api, hocuspocus)
#
# Configuration:
#   - Traefik static config: ./scripts/traefik/traefik.yml
#   - Dynamic routing: Docker labels (below)
#
# Rolling-Deploy Strategy (best-effort, NOT true zero-downtime):
#   Traefik only routes to HEALTHY containers. Prod deploy uses
#   `up --no-recreate --scale` so a DEPLOY_TAG change does not recreate the
#   serving replicas. A plain `up --scale` without `--no-recreate` still
#   recreates old containers and takes the fleet to zero. retry@file on
#   idempotent routers masks connection errors during the hand-off.
#
# Usage:
#   docker compose -f docker-compose.prod.yml --env-file .env.production up -d
#
# Debugging (500 / crash loops) — run on the host that runs Compose:
#   docker compose -f docker-compose.prod.yml --env-file .env.production ps -a
#   docker compose -f docker-compose.prod.yml --env-file .env.production logs -f --tail=300 webapp
#   docker compose -f docker-compose.prod.yml --env-file .env.production logs -f --tail=300 rest-api
#   docker compose -f docker-compose.prod.yml --env-file .env.production logs -f --tail=200 traefik
#   docker compose -f docker-compose.prod.yml --env-file .env.production logs -f --tail=200 hocuspocus-server
# Traefik dashboard (bound to 127.0.0.1:8080): ssh tunnel then open http://127.0.0.1:8080
#
# Temporary verbose backend logs (add to .env.production, redeploy rest-api / worker / ws):
#   LOG_LEVEL=debug
#   HTTP_LOG_LEVEL=debug
#   REST_LOG_LEVEL=debug          # rest-api route/service logs (default error-only)
#   HOCUSPOCUS_LOGGER=true        # noisy; only when debugging collab
#
# Local notes: copy this block into Notes/server if you keep a private runbook there (Notes/ is gitignored).
#
# Naming Convention:
#   - Project: docsplus
#   - Containers: docsplus-{service}-{replica} (e.g., docsplus-webapp-1)
#   - Images: docsplus-{service}:{tag}
#   - Network: docsplus-network
#
# =============================================================================

name: docsplus

services:
  # ===========================================================================
  # TRAEFIK - Reverse Proxy & SSL
  # Static config:  ./scripts/traefik/traefik.yml
  # Dynamic config: ./scripts/traefik/dynamic/
  # ===========================================================================
  traefik:
    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    command:
      - '--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:-admin@docs.plus}'
    ports:
      - '80:80'
      - '443:443'
      - '127.0.0.1:8080:8080'
    volumes:
      - ./scripts/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - ./scripts/traefik/dynamic:/etc/traefik/dynamic:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certs:/letsencrypt
    networks:
      - docsplus-network
    labels:
      - 'traefik.enable=false'
    # Docker log rotation
    logging:
      driver: 'json-file'
      options:
        max-size: '50m'
        max-file: '5'
        compress: 'true'
    healthcheck:
      test: ['CMD', 'traefik', 'healthcheck', '--ping']
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M

  # ===========================================================================
  # REDIS - Shared Cache, Pub/Sub, and Queues
  # Single Redis instance (simpler, sufficient for 2-5k users)
  # ===========================================================================
  redis:
    image: redis:7-alpine
    container_name: docsplus-redis
    restart: always
    command: >
      redis-server
      --appendonly yes
      --appendfsync everysec
      --maxmemory 3gb
      --maxmemory-policy volatile-lru
      --save ""
      --stop-writes-on-bgsave-error no
      --tcp-backlog 511
      --timeout 0
      --tcp-keepalive 300
      --maxclients 10000
      --lazyfree-lazy-eviction yes
      --lazyfree-lazy-expire yes
      --lazyfree-lazy-server-del yes
    volumes:
      - redis-data:/data
    networks:
      - docsplus-network
    sysctls:
      - net.core.somaxconn=511
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    logging:
      driver: 'json-file'
      options:
        max-size: '50m'
        max-file: '3'
    deploy:
      resources:
        limits:
          # maxmemory stays 3gb; the extra cgroup headroom absorbs the
          # AOF-rewrite fork's copy-on-write spike instead of OOM-killing the
          # one Redis carrying WS sync + queues + cache.
          memory: 4096M
        reservations:
          memory: 1G

  # ===========================================================================
  # REST API (Hocuspocus)
  # Handles HTTP requests and queues jobs - does NOT process jobs
  # ===========================================================================
  # ===========================================================================
  # ONE-SHOT MIGRATION GATE — single prod migration runner (mirrors glitchtip-migrate)
  # Invoked by the deploy workflow via `compose run --rm migrate` BEFORE app
  # replicas scale up; fail-fast (no mask). App services set RUN_MIGRATIONS=0.
  # ===========================================================================
  migrate:
    image: docsplus-hocuspocus:${DEPLOY_TAG:-latest}
    env_file: .env.production
    restart: 'no'
    entrypoint: ['sh', '-c', 'cd /app/apps/hocuspocus.server && bunx prisma@6.19.3 migrate deploy']
    environment:
      DATABASE_URL: ${DATABASE_URL}
    networks:
      - docsplus-network

  rest-api:
    image: docsplus-rest-api:${DEPLOY_TAG:-latest}
    env_file: .env.production
    build:
      context: .
      dockerfile: apps/hocuspocus.server/docker/Dockerfile.bun
      target: production
    restart: always
    stop_grace_period: 30s
    stop_signal: SIGTERM
    command: bun src/index.ts
    environment:
      NODE_ENV: production
      RUN_MIGRATIONS: '0' # one-shot `migrate` service is the single migration runner
      APP_PORT: 4000
      # Content applies forward to the collaboration process's internal listener.
      HOCUSPOCUS_INTERNAL_URL: http://hocuspocus-server:4003
      # Pino — see apps/hocuspocus.server/src/lib/logger.ts
      LOG_LEVEL: ${LOG_LEVEL:-info}
      HTTP_LOG_LEVEL: ${HTTP_LOG_LEVEL:-}
      REST_LOG_LEVEL: ${REST_LOG_LEVEL:-info}
      DATABASE_URL: ${DATABASE_URL}
      REDIS_HOST: docsplus-redis
      REDIS_PORT: 6379
      DB_POOL_SIZE: ${DB_POOL_SIZE:-5}
      DB_IDLE_TIMEOUT: 30000
      SUPABASE_URL: ${SUPABASE_URL}
      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
      # ALLOWED_ORIGINS loaded from env_file
      # S3 Storage (DigitalOcean Spaces)
      DO_STORAGE_ENDPOINT: ${DO_STORAGE_ENDPOINT}
      DO_STORAGE_REGION: ${DO_STORAGE_REGION}
      DO_STORAGE_ACCESS_KEY_ID: ${DO_STORAGE_ACCESS_KEY_ID}
      DO_STORAGE_SECRET_ACCESS_KEY: ${DO_STORAGE_SECRET_ACCESS_KEY}
      DO_STORAGE_BUCKET: ${DO_STORAGE_BUCKET}
      DO_STORAGE_MAX_FILE_SIZE: ${DO_STORAGE_MAX_FILE_SIZE:-10485760}
      # This server's own public origin — ORIGIN ONLY, no `/api` suffix, because
      # route paths are appended and the result is persisted into document
      # content. Unset means .docx images import as dropped-image warnings.
      PUBLIC_RESTAPI_URL: ${PUBLIC_RESTAPI_URL}
      # VAPID public key (needed for API responses, not sending)
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
      GLITCHTIP_DSN: ${GLITCHTIP_DSN:-}
      GIT_HASH: ${GIT_HASH:-${DEPLOY_TAG:-}}
      SENTRY_ROLE: rest-api
    networks:
      - docsplus-network
    depends_on:
      redis:
        condition: service_healthy
    labels:
      - 'traefik.enable=true'
      # REST API routes (prodback.docs.plus/api/*)
      - 'traefik.http.routers.rest-api.rule=Host(`prodback.docs.plus`) && PathPrefix(`/api`)'
      - 'traefik.http.routers.rest-api.entrypoints=websecure'
      - 'traefik.http.routers.rest-api.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.rest-api.service=rest-api'
      - 'traefik.http.routers.rest-api.middlewares=security-headers@file,rate-limit-api@file,retry@file'
      # Health routes (prodback.docs.plus/health/*) - for admin dashboard monitoring
      - 'traefik.http.routers.rest-api-health.rule=Host(`prodback.docs.plus`) && PathPrefix(`/health`)'
      - 'traefik.http.routers.rest-api-health.entrypoints=websecure'
      - 'traefik.http.routers.rest-api-health.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.rest-api-health.service=rest-api'
      - 'traefik.http.routers.rest-api-health.middlewares=security-headers@file'
      - 'traefik.http.services.rest-api.loadbalancer.server.port=4000'
      # Health check - only route to healthy containers. Liveness on purpose, and
      # on a different path from the collaboration block. Both replicas share one
      # Redis and one database, so a dependency probe empties the pool. REST's
      # `/health` runs the dependency check the admin dashboard reads, so liveness
      # needed a route of its own.
      - 'traefik.http.services.rest-api.loadbalancer.healthcheck.path=/health/live'
      - 'traefik.http.services.rest-api.loadbalancer.healthcheck.interval=5s'
      - 'traefik.http.services.rest-api.loadbalancer.healthcheck.timeout=3s'
    # Dependencies, not /health/live. The deploy waits on this container status
    # before it stops the old replicas. A port-open-only answer would then retire
    # working replicas in favour of broken ones.
    healthcheck:
      test:
        [
          'CMD',
          'bun',
          '-e',
          "fetch('http://localhost:4000/health').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))"
        ]
      interval: 10s
      timeout: 5s
      retries: 5 # More retries
      start_period: 30s
    logging:
      driver: 'json-file'
      options:
        max-size: '50m'
        max-file: '5'
        compress: 'true'
    deploy:
      replicas: 2
      resources:
        limits:
          # Ceilings sized for burst, not steady state — idle services yield
          # via CPU shares; quotas only stop one container monopolizing.
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================================================
  # HOCUSPOCUS WEBSOCKET SERVER
  # Real-time collaboration - does NOT process background jobs
  # ===========================================================================
  hocuspocus-server:
    image: docsplus-hocuspocus:${DEPLOY_TAG:-latest}
    env_file: .env.production
    build:
      context: .
      dockerfile: apps/hocuspocus.server/docker/Dockerfile.bun
      target: production
    restart: always
    stop_grace_period: 30s
    stop_signal: SIGTERM
    command: bun src/hocuspocus.server.ts
    environment:
      NODE_ENV: production
      RUN_MIGRATIONS: '0' # one-shot `migrate` service is the single migration runner
      HOCUSPOCUS_PORT: 4001
      # Internal listener: /metrics for Prometheus plus the content-apply
      # endpoint. Not host-published and never Traefik-routed. Stated explicitly
      # here — this is where an operator would change it, and it is what keeps
      # the cross-container Prometheus scrape alive if the default ever tightens.
      HOCUSPOCUS_INTERNAL_HTTP_HOST: 0.0.0.0
      LOG_LEVEL: ${LOG_LEVEL:-info}
      HTTP_LOG_LEVEL: ${HTTP_LOG_LEVEL:-}
      WS_LOG_LEVEL: ${WS_LOG_LEVEL:-}
      DATABASE_URL: ${DATABASE_URL}
      REDIS_HOST: docsplus-redis
      REDIS_PORT: 6379
      DB_POOL_SIZE: ${DB_POOL_SIZE:-5}
      DB_IDLE_TIMEOUT: 30000
      SUPABASE_URL: ${SUPABASE_URL}
      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
      # ALLOWED_ORIGINS loaded from env_file
      HOCUSPOCUS_LOGGER: 'false'
      HOCUSPOCUS_THROTTLE: 'true'
      # S3 Storage (DigitalOcean Spaces)
      DO_STORAGE_ENDPOINT: ${DO_STORAGE_ENDPOINT}
      DO_STORAGE_REGION: ${DO_STORAGE_REGION}
      DO_STORAGE_ACCESS_KEY_ID: ${DO_STORAGE_ACCESS_KEY_ID}
      DO_STORAGE_SECRET_ACCESS_KEY: ${DO_STORAGE_SECRET_ACCESS_KEY}
      DO_STORAGE_BUCKET: ${DO_STORAGE_BUCKET}
      DO_STORAGE_MAX_FILE_SIZE: ${DO_STORAGE_MAX_FILE_SIZE:-10485760}
      GLITCHTIP_DSN: ${GLITCHTIP_DSN:-}
      GIT_HASH: ${GIT_HASH:-${DEPLOY_TAG:-}}
      SENTRY_ROLE: hocuspocus-server
    networks:
      - docsplus-network
    depends_on:
      redis:
        condition: service_healthy
    labels:
      - 'traefik.enable=true'
      # WebSocket routes (prodback.docs.plus/websocket)
      - 'traefik.http.routers.hocuspocus.rule=Host(`prodback.docs.plus`) && PathPrefix(`/websocket`)'
      - 'traefik.http.routers.hocuspocus.entrypoints=websecure'
      - 'traefik.http.routers.hocuspocus.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.hocuspocus.service=hocuspocus'
      - 'traefik.http.routers.hocuspocus.middlewares=security-headers@file'
      - 'traefik.http.services.hocuspocus.loadbalancer.server.port=4001'
      - 'traefik.http.services.hocuspocus.loadbalancer.sticky.cookie=true'
      - 'traefik.http.services.hocuspocus.loadbalancer.sticky.cookie.name=hocuspocus_sticky'
      - 'traefik.http.services.hocuspocus.loadbalancer.sticky.cookie.httponly=true'
      - 'traefik.http.services.hocuspocus.loadbalancer.sticky.cookie.secure=true'
      - 'traefik.http.services.hocuspocus.loadbalancer.sticky.cookie.samesite=lax'
      # Health check for load balancer. Liveness on purpose: Traefik would pull a
      # replica with live rooms attached off the pool on a transient DB blip.
      - 'traefik.http.services.hocuspocus.loadbalancer.healthcheck.path=/health'
      - 'traefik.http.services.hocuspocus.loadbalancer.healthcheck.interval=5s'
    # Readiness, not /health: the deploy reads this container status and then
    # stops every old replica, so a port-open-only answer would retire replicas
    # that can load documents in favour of replicas that cannot.
    healthcheck:
      test:
        [
          'CMD',
          'bun',
          '-e',
          "fetch('http://localhost:4001/health/ready').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))"
        ]
      interval: 10s
      timeout: 5s
      retries: 5 # More retries
      start_period: 30s
    logging:
      driver: 'json-file'
      options:
        max-size: '50m'
        max-file: '5'
        compress: 'true'
    deploy:
      replicas: 2
      resources:
        limits:
          # Ceiling, not reservation: the store hook and Yjs sync are
          # CPU-bound bursts — a 0.5 CFS quota throttled them past the 0.5s
          # persist alert. Let each replica burst toward the free cores.
          cpus: '2.0'
          memory: 1024M
        reservations:
          cpus: '0.5'
          memory: 512M

  # ===========================================================================
  # HOCUSPOCUS WORKER (Background Jobs)
  # Processes ALL queued jobs: documents, emails, push notifications
  # This is the ONLY container that runs BullMQ workers (not rest-api)
  #
  # SCALING NOTE: BullMQ handles job deduplication atomically via Redis locks.
  # Multiple workers will NOT process the same job twice. Safe to scale to 2+.
  # ===========================================================================
  hocuspocus-worker:
    image: docsplus-hocuspocus:${DEPLOY_TAG:-latest}
    env_file: .env.production
    build:
      context: .
      dockerfile: apps/hocuspocus.server/docker/Dockerfile.bun
      target: production
    restart: always
    # Grace period must exceed lockDuration (2min) to allow jobs to complete
    stop_grace_period: 150s
    stop_signal: SIGTERM
    command: bun src/hocuspocus.worker.ts
    environment:
      NODE_ENV: production
      RUN_MIGRATIONS: '0' # one-shot `migrate` service is the single migration runner
      WORKER_HEALTH_PORT: 4002
      LOG_LEVEL: ${LOG_LEVEL:-info}
      WORKER_LOG_LEVEL: ${WORKER_LOG_LEVEL:-}
      DATABASE_URL: ${DATABASE_URL}
      REDIS_HOST: docsplus-redis
      REDIS_PORT: 6379
      # Concurrency is pinned to the pool per replica: more concurrent jobs
      # than connections just converts queue latency into P2028 pool-wait
      # errors that burn the retry budget (overrides env_file's global value).
      DB_POOL_SIZE: ${WORKER_DB_POOL_SIZE:-10}
      BULLMQ_CONCURRENCY: ${WORKER_DB_POOL_SIZE:-10}
      DB_IDLE_TIMEOUT: 30000
      SUPABASE_URL: ${SUPABASE_URL}
      SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY}
      SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY}
      # S3 Storage (DigitalOcean Spaces)
      DO_STORAGE_ENDPOINT: ${DO_STORAGE_ENDPOINT}
      DO_STORAGE_REGION: ${DO_STORAGE_REGION}
      DO_STORAGE_ACCESS_KEY_ID: ${DO_STORAGE_ACCESS_KEY_ID}
      DO_STORAGE_SECRET_ACCESS_KEY: ${DO_STORAGE_SECRET_ACCESS_KEY}
      DO_STORAGE_BUCKET: ${DO_STORAGE_BUCKET}
      # This server's own public origin. The worker needs it because the RFC 8058
      # List-Unsubscribe header must point at the API, not the webapp page.
      PUBLIC_RESTAPI_URL: ${PUBLIC_RESTAPI_URL}
      # Email gateway creds (SMTP_*, RESEND_API_KEY) and EMAIL_UNSUBSCRIBE_SECRET
      # load from env_file only — re-declaring SMTP_PASS here as ${SMTP_PASS} let
      # a stale deploy-shell var override env_file and poison the container
      # (2026-07-24 535 outage).
      # Push Notifications (VAPID)
      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
      VAPID_SUBJECT: ${VAPID_SUBJECT:-mailto:support@docs.plus}
      # Worker resilience settings (shutdown timeout should be < stop_grace_period)
      WORKER_SHUTDOWN_TIMEOUT_MS: 120000
      GLITCHTIP_DSN: ${GLITCHTIP_DSN:-}
      GIT_HASH: ${GIT_HASH:-${DEPLOY_TAG:-}}
      SENTRY_ROLE: hocuspocus-worker
    networks:
      - docsplus-network
    depends_on:
      redis:
        condition: service_healthy
    # Worker doesn't need Traefik labels (internal only)
    healthcheck:
      test:
        [
          'CMD',
          'bun',
          '-e',
          "fetch('http://localhost:4002/health').then(r => r.json()).then(h => h.status === 'healthy' ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))"
        ]
      interval: 15s
      timeout: 10s
      retries: 3
      start_period: 45s
    logging:
      driver: 'json-file'
      options:
        max-size: '50m'
        max-file: '5'
        compress: 'true'
    deploy:
      # BullMQ uses Redis atomic ops for job claiming - safe to run multiple workers
      # 2 replicas provides redundancy without excessive resource usage
      replicas: 2
      resources:
        limits:
          # Workers now own the Yjs decode/strip CPU for every save — give
          # them burst headroom; throughput is DB-bound, not quota-bound.
          cpus: '2.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 256M

  # ===========================================================================
  # WEBAPP (Next.js Frontend)
  # ===========================================================================
  webapp:
    image: docsplus-webapp:${DEPLOY_TAG:-latest}
    env_file: .env.production
    build:
      context: .
      dockerfile: apps/webapp/docker/Dockerfile.bun
      target: runner
      args:
        NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
        NEXT_PUBLIC_SUPABASE_WS_URL: ${NEXT_PUBLIC_SUPABASE_WS_URL}
        # Next inlines NEXT_PUBLIC_* at build time, so a runtime-only value never
        # reaches the client bundle. Both must be build args.
        NEXT_PUBLIC_SUPABASE_OTP_EMAIL_REDIRECT: ${NEXT_PUBLIC_SUPABASE_OTP_EMAIL_REDIRECT:-}
        NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-https://docs.plus}
        NEXT_PUBLIC_PROVIDER_URL: ${NEXT_PUBLIC_PROVIDER_URL}
        NEXT_PUBLIC_RESTAPI_URL: ${NEXT_PUBLIC_RESTAPI_URL}
        NEXT_PUBLIC_GOOGLE_CLIENT_ID: ${NEXT_PUBLIC_GOOGLE_CLIENT_ID}
        NEXT_PUBLIC_GA_ID: ${NEXT_PUBLIC_GA_ID}
        NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${NEXT_PUBLIC_TURNSTILE_SITE_KEY}
        NEXT_PUBLIC_VAPID_PUBLIC_KEY: ${NEXT_PUBLIC_VAPID_PUBLIC_KEY}
        NEXT_PUBLIC_VIRTUOSO_LICENSE: ${NEXT_PUBLIC_VIRTUOSO_LICENSE}
        NEXT_PUBLIC_GLITCHTIP_DSN: ${NEXT_PUBLIC_GLITCHTIP_DSN:-}
        SENTRY_URL: ${SENTRY_URL:-}
        SENTRY_AUTH_TOKEN: ${SENTRY_AUTH_TOKEN:-}
        SENTRY_ORG: ${SENTRY_ORG:-}
        SENTRY_PROJECT: ${SENTRY_PROJECT:-}
        GIT_HASH: ${GIT_HASH:-${DEPLOY_TAG:-}}
        NEXT_PUBLIC_GIT_HASH: ${NEXT_PUBLIC_GIT_HASH:-${GIT_HASH:-${DEPLOY_TAG:-}}}
    restart: always # Always restart on failure
    stop_grace_period: 30s
    stop_signal: SIGTERM
    environment:
      NODE_ENV: production
      PORT: 3000
      HOSTNAME: '0.0.0.0'
      # NEXT_PUBLIC vars for runtime
      NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
      NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-https://docs.plus}
      NEXT_PUBLIC_PROVIDER_URL: ${NEXT_PUBLIC_PROVIDER_URL}
      NEXT_PUBLIC_RESTAPI_URL: ${NEXT_PUBLIC_RESTAPI_URL}
      NEXT_PUBLIC_GOOGLE_CLIENT_ID: ${NEXT_PUBLIC_GOOGLE_CLIENT_ID}
      NEXT_PUBLIC_GA_ID: ${NEXT_PUBLIC_GA_ID}
      NEXT_PUBLIC_TURNSTILE_SITE_KEY: ${NEXT_PUBLIC_TURNSTILE_SITE_KEY}
      NEXT_PUBLIC_VAPID_PUBLIC_KEY: ${NEXT_PUBLIC_VAPID_PUBLIC_KEY}
      NEXT_PUBLIC_GLITCHTIP_DSN: ${NEXT_PUBLIC_GLITCHTIP_DSN:-}
      # Server-side API URL (internal Docker network)
      SERVER_RESTAPI_URL: http://rest-api:4000/api
    networks:
      - docsplus-network
    labels:
      - 'traefik.enable=true'
      # Main frontend (docs.plus)
      - 'traefik.http.routers.webapp.rule=Host(`docs.plus`) || Host(`new.docs.plus`) || Host(`www.new.docs.plus`)'
      - 'traefik.http.routers.webapp.entrypoints=websecure'
      - 'traefik.http.routers.webapp.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.webapp.service=webapp'
      - 'traefik.http.routers.webapp.middlewares=security-headers@file,compress@file,rate-limit-web@file,retry@file'
      - 'traefik.http.services.webapp.loadbalancer.server.port=3000'
      # Health check - Traefik only routes to healthy containers
      - 'traefik.http.services.webapp.loadbalancer.healthcheck.path=/api/health'
      - 'traefik.http.services.webapp.loadbalancer.healthcheck.interval=5s'
      - 'traefik.http.services.webapp.loadbalancer.healthcheck.timeout=3s'
    healthcheck:
      test:
        [
          'CMD',
          'bun',
          '-e',
          "fetch('http://localhost:3000/api/health').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))"
        ]
      interval: 10s
      timeout: 5s
      retries: 5 # More retries
      start_period: 30s
    logging:
      driver: 'json-file'
      options:
        max-size: '50m'
        max-file: '5'
        compress: 'true'
    deploy:
      replicas: 2
      resources:
        limits:
          # SSR bursts (slug pages) benefit from a full core; shares keep it
          # fair against the realtime tier under contention.
          cpus: '1.0'
          memory: 768M
        reservations:
          cpus: '0.25'
          memory: 256M

  # ===========================================================================
  # ADMIN DASHBOARD (Next.js)
  # Internal admin interface - single replica, restricted access
  # ===========================================================================
  admin-dashboard:
    image: docsplus-admin:${DEPLOY_TAG:-latest}
    env_file: .env.production
    build:
      context: .
      dockerfile: apps/admin-dashboard/docker/Dockerfile.bun
      target: runner
      args:
        NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
        NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-https://prodback.docs.plus}
        NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-https://docs.plus}
        NEXT_PUBLIC_GLITCHTIP_DSN: ${NEXT_PUBLIC_GLITCHTIP_DSN:-}
        GIT_HASH: ${GIT_HASH:-${DEPLOY_TAG:-}}
        NEXT_PUBLIC_GIT_HASH: ${NEXT_PUBLIC_GIT_HASH:-${GIT_HASH:-${DEPLOY_TAG:-}}}
    restart: always
    stop_grace_period: 30s
    stop_signal: SIGTERM
    environment:
      NODE_ENV: production
      PORT: 3100
      HOSTNAME: '0.0.0.0'
      NEXT_PUBLIC_SUPABASE_URL: ${NEXT_PUBLIC_SUPABASE_URL}
      NEXT_PUBLIC_SUPABASE_ANON_KEY: ${NEXT_PUBLIC_SUPABASE_ANON_KEY}
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-https://prodback.docs.plus}
      NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-https://docs.plus}
      NEXT_PUBLIC_GLITCHTIP_DSN: ${NEXT_PUBLIC_GLITCHTIP_DSN:-}
    networks:
      - docsplus-network
    labels:
      - 'traefik.enable=true'
      # Admin dashboard (admin.docs.plus)
      - 'traefik.http.routers.admin.rule=Host(`admin.docs.plus`)'
      - 'traefik.http.routers.admin.entrypoints=websecure'
      - 'traefik.http.routers.admin.tls.certresolver=letsencrypt'
      - 'traefik.http.routers.admin.service=admin'
      - 'traefik.http.routers.admin.middlewares=security-headers@file,compress@file'
      - 'traefik.http.services.admin.loadbalancer.server.port=3100'
      # Health check
      - 'traefik.http.services.admin.loadbalancer.healthcheck.path=/api/health'
      - 'traefik.http.services.admin.loadbalancer.healthcheck.interval=10s'
    healthcheck:
      test:
        [
          'CMD',
          'bun',
          '-e',
          "fetch('http://localhost:3100/api/health').then(r => r.ok ? process.exit(0) : process.exit(1)).catch(() => process.exit(1))"
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    logging:
      driver: 'json-file'
      options:
        max-size: '50m'
        max-file: '3'
    deploy:
      replicas: 1
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.1'
          memory: 128M

# =============================================================================
# VOLUMES
# =============================================================================
volumes:
  traefik-certs:
    driver: local
  redis-data:
    driver: local

# =============================================================================
# NETWORKS
# =============================================================================
networks:
  docsplus-network:
    external: true
    name: docsplus-network