services:
  web:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        - APP_ENV=production
        - BUILD_VERSION=1.0.0
    image: myapp:latest
    ports:
      - "8080:80"
      - "8443:443"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgres://db:5432/myapp
      - REDIS_URL=redis://cache:6379
    env_file:
      - .env
    volumes:
      - ./uploads:/app/uploads
      - static_files:/app/static
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_started
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    networks:
      - frontend
      - backend
    deploy:
      replicas: 2
      resources:
        limits:
          cpus: "0.5"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 256M

  db:
    image: postgres:15
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: appuser
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    volumes:
      - db_data:/var/lib/postgresql/data
      - ./init-scripts:/docker-entrypoint-initdb.d
    secrets:
      - db_password
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U appuser -d myapp"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend

  cache:
    image: redis:7-alpine
    command: redis-server --maxmemory 256mb --maxmemory-policy allkeys-lru
    volumes:
      - cache_data:/data
    networks:
      - backend

  worker:
    build:
      context: .
    command: python manage.py rqworker default
    environment:
      - DJANGO_SETTINGS_MODULE=config.settings.production
    volumes:
      - ./uploads:/app/uploads
    depends_on:
      - db
      - cache
    restart: on-failure
    networks:
      - backend

volumes:
  db_data:
    driver: local
  cache_data:
    driver: local
  static_files:
    driver: local

secrets:
  db_password:
    file: ./secrets/db_password.txt

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge
    internal: true
