# Production deployment — occupymedia.cc
# One box, everything behind the Cloudflare tunnel (no inbound ports).
# See DEPLOY.md. Ports bind to 127.0.0.1 ONLY — the tunnel reaches them on localhost.

name: occupymedia

services:
  # ---------- core ----------
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-occupymedia}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
      POSTGRES_DB: ${POSTGRES_DB:-occupymedia}
    volumes: [pgdata:/var/lib/postgresql/data]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-occupymedia}"]
      interval: 5s
      retries: 10
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    command: ["redis-server", "--appendonly", "yes"]
    volumes: [redisdata:/data]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      retries: 10
    restart: unless-stopped

  temporal:
    image: temporalio/auto-setup:1.24
    depends_on:
      postgres: { condition: service_healthy }
    environment:
      DB: postgres12
      DB_PORT: 5432
      POSTGRES_USER: ${POSTGRES_USER:-occupymedia}
      POSTGRES_PWD: ${POSTGRES_PASSWORD:?}
      POSTGRES_SEEDS: postgres
    restart: unless-stopped

  # ---------- app (built from the repo; see Dockerfile) ----------
  api:
    build:
      context: ../..
      dockerfile: infra/occupymedia/Dockerfile
      args: { APP: api }
    environment: &appenv
      PORT: "3000"
      DATABASE_URL: postgres://${POSTGRES_USER:-occupymedia}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-occupymedia}
      REDIS_HOST: redis
      TEMPORAL_HOST: temporal:7233
      S3_ENDPOINT: https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com
      S3_REGION: auto
      S3_ACCESS_KEY: ${R2_ACCESS_KEY:?}
      S3_SECRET_KEY: ${R2_SECRET_KEY:?}
      S3_BUCKET: occupymedia-media-encrypted
      S3_KEK: ${S3_KEK:?generate once, never rotate casually — it wraps every stored blob}
      WEB_ORIGIN: https://app.occupymedia.cc
      API_PUBLIC_URL: https://api.occupymedia.cc
    ports: ["127.0.0.1:3000:3000"]
    depends_on:
      postgres: { condition: service_healthy }
      redis: { condition: service_healthy }
    restart: unless-stopped

  scheduler:
    build:
      context: ../..
      dockerfile: infra/occupymedia/Dockerfile
      args: { APP: scheduler }
    environment:
      <<: *appenv
      PORT: "3010"
    depends_on:
      postgres: { condition: service_healthy }
      redis: { condition: service_healthy }
      temporal: { condition: service_started }
    restart: unless-stopped

  web:
    build:
      context: ../..
      dockerfile: infra/occupymedia/Dockerfile
      args:
        APP: web
        NEXT_PUBLIC_API_URL: https://api.occupymedia.cc
    environment:
      <<: *appenv
      PORT: "3001"
    ports: ["127.0.0.1:3001:3001"]
    depends_on: [api]
    restart: unless-stopped

  media-worker:
    build:
      context: ../..
      dockerfile: infra/media-worker.Dockerfile
    environment:
      <<: *appenv
      PORT: "3100"
      MEDIA_WORKER_ID: worker-1
      MEDIA_FENCE_PATH: /var/lib/media-worker/fence.json
      POSTGRES_HOST: postgres
      REDIS_HOST: redis
      PEERTUBE_PUSH_URL: rtmp://peertube:1935/live   # internal; live ingest only
    volumes: [mediaworkerstate:/var/lib/media-worker]
    depends_on:
      redis: { condition: service_healthy }
    restart: unless-stopped

  # ---------- front door ----------
  cloudflared:
    image: cloudflare/cloudflared:latest
    command: ["tunnel", "--no-autoupdate", "run"]
    environment:
      TUNNEL_TOKEN: ${CLOUDFLARE_TUNNEL_TOKEN:?}
    depends_on: [api, web, peertube, conduwuit]
    restart: unless-stopped

  # ---------- video plane ----------
  peertube:
    image: chocobozzz/peertube:production-bookworm
    env_file: peertube.env
    ports: ["127.0.0.1:9000:9000"]
    volumes:
      - peertube_config:/app/config
      - peertube_assets:/app/storage/client-overrides
    depends_on:
      peertube-postgres: { condition: service_healthy }
      peertube-redis: { condition: service_started }
      postfix: { condition: service_started }
    restart: unless-stopped

  peertube-postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: peertube
      POSTGRES_PASSWORD: ${PEERTUBE_DB_PASSWORD:?set in peertube.env}
      POSTGRES_DB: peertube
    volumes: [peertube_pgdata:/var/lib/postgresql/data]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U peertube"]
      interval: 5s
      retries: 10
    restart: unless-stopped

  peertube-redis:
    image: redis:7-alpine
    restart: unless-stopped

  postfix:
    image: mwader/postfix-relay
    environment:
      - POSTFIX_myhostname=tube.occupymedia.cc
    restart: unless-stopped

  # ---------- chat plane ----------
  conduwuit:
    image: girlbossceo/conduwuit:latest
    volumes:
      - conduwuit_data:/var/lib/conduwuit
      - ./conduwuit.toml:/etc/conduwuit/conduwuit.toml:ro
    ports: ["127.0.0.1:8448:6167"]
    restart: unless-stopped

  # Telegram bridge — first run is interactive: docker compose run --rm mautrix-telegram
  mautrix-telegram:
    image: dock.mau.dev/mautrix/telegram:latest
    volumes: [mautrix_telegram_data:/data]
    depends_on: [conduwuit]
    profiles: ["bridges"]
    restart: unless-stopped

volumes:
  pgdata:
  redisdata:
  mediaworkerstate:
  peertube_pgdata:
  peertube_config:
  peertube_assets:
  conduwuit_data:
  mautrix_telegram_data: