# Production docker-compose with TLS and authentication
#
# Usage:
#   1. Generate TLS certificates in ./certs/
#   2. Generate auth token hash: echo -n "your-secret-token" | sha256sum
#   3. Update RSTMDB_AUTH_TOKEN_HASH with the hash
#   4. Run: docker compose -f docker-compose.prod.yml up -d

services:
  rstmdb:
    image: rstmdb/rstmdb:latest
    container_name: rstmdb
    restart: always
    ports:
      - "7401:7401"
      - "9090:9090"
    volumes:
      - rstmdb-data:/data
      - ./certs:/certs:ro
    environment:
      RUST_LOG: info
      RSTMDB_BIND: 0.0.0.0:7401
      RSTMDB_DATA: /data
      # Metrics
      RSTMDB_METRICS_ENABLED: "true"
      RSTMDB_METRICS_BIND: "0.0.0.0:9090"
      # Authentication
      RSTMDB_AUTH_REQUIRED: "true"
      RSTMDB_AUTH_TOKEN_HASH: "${RSTMDB_AUTH_TOKEN_HASH:?Set RSTMDB_AUTH_TOKEN_HASH}"
      # TLS
      RSTMDB_TLS_ENABLED: "true"
      RSTMDB_TLS_CERT: /certs/server-cert.pem
      RSTMDB_TLS_KEY: /certs/server-key.pem
      # Optional: Enable mTLS (mutual TLS)
      # RSTMDB_TLS_REQUIRE_CLIENT_CERT: "true"
      # RSTMDB_TLS_CLIENT_CA: /certs/ca-cert.pem
      # Compaction
      RSTMDB_COMPACT_ENABLED: "true"
      RSTMDB_COMPACT_EVENTS: "10000"
      RSTMDB_COMPACT_SIZE_MB: "100"
      RSTMDB_COMPACT_INTERVAL: "300"
      # Performance
      RSTMDB_FSYNC_POLICY: every_write
    healthcheck:
      test: ["CMD", "rstmdb-cli", "-s", "127.0.0.1:7401", "--tls", "-k", "ping"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "2"
        reservations:
          memory: 256M
          cpus: "0.5"
    logging:
      driver: json-file
      options:
        max-size: "100m"
        max-file: "3"

  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: always
    volumes:
      - ./grafana/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    ports:
      - "9091:9090"
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'
      - '--web.console.libraries=/etc/prometheus/console_libraries'
      - '--web.console.templates=/etc/prometheus/consoles'
      - '--web.enable-lifecycle'
    depends_on:
      - rstmdb

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: always
    volumes:
      - ./grafana/provisioning:/etc/grafana/provisioning:ro
      - ./grafana/dashboards:/var/lib/grafana/dashboards:ro
      - grafana-data:/var/lib/grafana
    ports:
      - "3000:3000"
    environment:
      GF_SECURITY_ADMIN_USER: admin
      GF_SECURITY_ADMIN_PASSWORD: "${GRAFANA_ADMIN_PASSWORD:-admin}"
      GF_DASHBOARDS_DEFAULT_HOME_DASHBOARD_PATH: /var/lib/grafana/dashboards/rstmdb.json
      GF_USERS_ALLOW_SIGN_UP: "false"
    depends_on:
      - prometheus

volumes:
  rstmdb-data:
    driver: local
  prometheus-data:
    driver: local
  grafana-data:
    driver: local
