docker-compose.yml

# RuneBolt Production Docker Compose Configuration
# Version: 1.0.0
# Usage: docker stack deploy -c docker-compose.yml runebolt

version: '3.8'

services:
  # FRONTEND (Next.js)
  frontend:
    image: ghcr.io/bitmap-asset/runebolt-frontend:${VERSION:-latest}
    deploy:
      replicas: 3
      update_config:
        parallelism: 1
        delay: 10s
        order: start-first
        failure_action: rollback
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 3
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
      placement:
        constraints:
          - node.role == worker
    environment:
      - NODE_ENV=production
      - NEXT_PUBLIC_API_URL=https://api.runebolt.io
      - NEXT_PUBLIC_WS_URL=wss://ws.runebolt.io
      - PORT=3000
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - frontend
      - monitoring

  # BACKEND API
  backend-api:
    image: ghcr.io/bitmap-asset/runebolt-backend:${VERSION:-latest}
    deploy:
      replicas: 3
      update_config:
        parallelism: 1
        delay: 15s
        order: start-first
        failure_action: rollback
      restart_policy:
        condition: any
        delay: 5s
        max_attempts: 3
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M
      placement:
        constraints:
          - node.role == worker
    environment:
      - NODE_ENV=production
      - PORT=3001
      - DATABASE_PATH=/data/runebolt.db
      - VAULT_ADDR=http://vault:8200
      - REDIS_URL=redis://redis:6379
      - POSTGRES_URL=postgresql://pgbouncer:6432/runebolt
    secrets:
      - vault_token
      - jwt_secret
    volumes:
      - backend-data:/data
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3001/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    networks:
      - backend
      - frontend
      - database
      - cache
      - monitoring

  # BACKEND WORKERS
  backend-worker:
    image: ghcr.io/bitmap-asset/runebolt-backend:${VERSION:-latest}
    command: ["node", "dist/worker.js"]
    deploy:
      replicas: 2
      restart_policy:
        condition: any
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    environment:
      - NODE_ENV=production
      - VAULT_ADDR=http://vault:8200
      - REDIS_URL=redis://redis:6379
      - POSTGRES_URL=postgresql://pgbouncer:6432/runebolt
    secrets:
      - vault_token
    volumes:
      - backend-data:/data
    networks:
      - backend
      - database
      - cache

  # LOAD BALANCER (HAProxy)
  haproxy:
    image: haproxy:2.8-alpine
    deploy:
      replicas: 2
      placement:
        constraints:
          - node.role == manager
    ports:
      - "80:80"
      - "443:443"
    configs:
      - source: haproxy_config
        target: /usr/local/etc/haproxy/haproxy.cfg
    secrets:
      - ssl_certificate
      - ssl_private_key
    networks:
      - frontend
      - backend

  # POSTGRESQL PRIMARY
  postgres-primary:
    image: postgres:15-alpine
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.database == primary
    environment:
      - POSTGRES_DB=runebolt
      - POSTGRES_USER=runebolt
      - POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
      - PGDATA=/var/lib/postgresql/data/pgdata
    secrets:
      - postgres_password
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - postgres-wal:/var/lib/postgresql/wal
    networks:
      - database

  # POSTGRESQL REPLICA
  postgres-replica:
    image: postgres:15-alpine
    deploy:
      replicas: 2
      placement:
        constraints:
          - node.labels.database == replica
    environment:
      - POSTGRES_DB=runebolt
      - POSTGRES_USER=runebolt
      - POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
      - REPLICATION_MODE=slave
    secrets:
      - postgres_password
    volumes:
      - postgres-replica-data:/var/lib/postgresql/data
    networks:
      - database

  # PGBOUNCER
  pgbouncer:
    image: pgbouncer/pgbouncer:1.20
    deploy:
      replicas: 2
    environment:
      - DATABASES_HOST=postgres-primary
      - DATABASES_PORT=5432
      - DATABASES_DATABASE=runebolt
      - POOL_MODE=transaction
      - MAX_CLIENT_CONN=1000
    secrets:
      - postgres_password
    networks:
      - database

  # REDIS
  redis:
    image: redis:7-alpine
    deploy:
      replicas: 3
      placement:
        max_replicas_per_node: 1
    command: redis-server --appendonly yes --maxmemory 2gb --maxmemory-policy allkeys-lru
    volumes:
      - redis-data:/data
    networks:
      - cache

  # VAULT
  vault:
    image: hashicorp/vault:1.15
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.labels.vault == true
    cap_add:
      - IPC_LOCK
    environment:
      - VAULT_ADDR=http://0.0.0.0:8200
    configs:
      - source: vault_config
        target: /vault/config/vault.hcl
    volumes:
      - vault-data:/vault/file
    networks:
      - backend

  # PROMETHEUS
  prometheus:
    image: prom/prometheus:v2.48
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.retention.time=30d'
    configs:
      - source: prometheus_config
        target: /etc/prometheus/prometheus.yml
    volumes:
      - prometheus-data:/prometheus
    networks:
      - monitoring

  # GRAFANA
  grafana:
    image: grafana/grafana:10.2
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    environment:
      - GF_SECURITY_ADMIN_PASSWORD__FILE=/run/secrets/grafana_admin_password
    secrets:
      - grafana_admin_password
    volumes:
      - grafana-data:/var/lib/grafana
    networks:
      - monitoring

  # LOKI
  loki:
    image: grafana/loki:2.9
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    volumes:
      - loki-data:/loki
    networks:
      - monitoring

networks:
  frontend:
    driver: overlay
    attachable: true
  backend:
    driver: overlay
    internal: true
    attachable: true
  database:
    driver: overlay
    internal: true
  cache:
    driver: overlay
    internal: true
  monitoring:
    driver: overlay
    attachable: true

volumes:
  backend-data:
    driver: rexray/ebs
  postgres-data:
    driver: rexray/ebs
  postgres-wal:
    driver: rexray/ebs
  postgres-replica-data:
    driver: rexray/ebs
  redis-data:
    driver: local
  vault-data:
    driver: rexray/ebs
  prometheus-data:
    driver: local
  grafana-data:
    driver: local
  loki-data:
    driver: local

secrets:
  vault_token:
    external: true
  jwt_secret:
    external: true
  postgres_password:
    external: true
  grafana_admin_password:
    external: true
  ssl_certificate:
    external: true
  ssl_private_key:
    external: true

configs:
  haproxy_config:
    external: true
  vault_config:
    external: true
  prometheus_config:
    external: true