docker-compose.prod.yml

services:
  payload:
    image: registry.cevi.tools/cevi/conveniat27-webpage:latest
    build:
      context: .
      dockerfile: Dockerfile
      args:
        - NEXT_PUBLIC_VAPID_PUBLIC_KEY=BGXpnSSQfJS84zCk6qka6-3qC_bTK6feOUaLz6ZJY6ThmdcY-h20V0QB8P8nq84Pb6vpbZLvYwISwlSmH9aZwjU
        - NEXT_PUBLIC_APP_HOST_URL=https://conveniat27.ch
        - NEXT_PUBLIC_POSTHOG_KEY=phc_QXeG5AHoyxCVCcIse8a2rriQKZgAwkk3vO15Zz0aDud
        - NEXT_PUBLIC_POSTHOG_HOST=https://eu.i.posthog.com
        - POSTHOG_API_KEY=${POSTHOG_API_KEY}
        - POSTHOG_PROJECT_ID=${POSTHOG_PROJECT_ID}

    deploy:
      replicas: 2

      update_config:
        parallelism: 1 # Update one replica at a time
        delay: 0s # No delay between updates
        order: start-first # Start new containers before stopping old ones
        monitor: 5s # Time to wait after an update to monitor for failure
        failure_action: pause # What to do if an update fails
        max_failure_ratio: 0.0 # Fail immediately if any container fails during update

      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 3
        window: 60s

      labels:
        - swarmpit.service.deployment.autoredeploy=true

        - traefik.enable=true

        # redirect conveniat.ch (HTTPS)
        - traefik.http.routers.conveniat-redirect-secure.rule=Host(`conveniat.ch`)
        - traefik.http.routers.conveniat-redirect-secure.entrypoints=websecure
        - traefik.http.routers.conveniat-redirect-secure.middlewares=redirect-to-conveniat27-from-conveniat

        - traefik.http.middlewares.redirect-to-conveniat27-from-conveniat.redirectregex.regex=^https?://conveniat.ch/(.*)
        - traefik.http.middlewares.redirect-to-conveniat27-from-conveniat.redirectregex.replacement=https://conveniat27.ch/$$$${1}
        - traefik.http.middlewares.redirect-to-conveniat27-from-conveniat.redirectregex.permanent=true

        # redirect conveniat.ch (HTTP to HTTPS for redirect)
        - traefik.http.routers.conveniat-redirect-http.rule=Host(`conveniat.ch`)
        - traefik.http.routers.conveniat-redirect-http.entrypoints=web
        - traefik.http.routers.conveniat-redirect-http.middlewares=redirect-to-https@file

        # short url
        - traefik.http.routers.short-con27-router.rule=Host(`con27.ch`)
        - traefik.http.routers.short-con27-router.entrypoints=websecure
        - traefik.http.routers.short-con27-router.middlewares=redirect-to-conveniat27
        - traefik.http.middlewares.redirect-to-conveniat27.redirectregex.regex=^https?://con27.ch/(.*)
        - traefik.http.middlewares.redirect-to-conveniat27.redirectregex.replacement=https://conveniat27.ch/go/$$$${1}
        - traefik.http.middlewares.redirect-to-conveniat27.redirectregex.permanent=true

        - traefik.http.routers.con27-router-http.rule=Host(`con27.ch`)
        - traefik.http.routers.con27-router-http.entrypoints=web
        - traefik.http.routers.con27-router-http.middlewares=redirect-to-https@file

        # HTTP gets redirected to HTTPS
        - traefik.http.routers.conveniat27-router-http.rule=Host(`conveniat27.ch`) || Host(`www.conveniat27.ch`)
        - traefik.http.routers.conveniat27-router-http.entrypoints=web
        - traefik.http.routers.conveniat27-router-http.middlewares=redirect-to-https@file

        - traefik.http.routers.conveniat27-router.rule=Host(`conveniat27.ch`) || Host(`www.conveniat27.ch`)
        - traefik.http.routers.conveniat27-router.entrypoints=websecure
        - traefik.http.routers.conveniat27-router.service=conveniat27
        - traefik.http.routers.conveniat27-router.middlewares=conveniat27-to-non-www,retry-middleware-prod

        - traefik.http.services.conveniat27.loadbalancer.server.port=3000

        - traefik.http.middlewares.conveniat27-to-non-www.redirectregex.regex=^https://www.conveniat27.ch/(.*)
        - traefik.http.middlewares.conveniat27-to-non-www.redirectregex.replacement=https://conveniat27.ch/$$$${1}
        - traefik.http.middlewares.conveniat27-to-non-www.redirectregex.permanent=true

        # Add Traefik healthcheck labels
        - traefik.http.services.conveniat27.loadbalancer.healthcheck.path=/status
        - traefik.http.services.conveniat27.loadbalancer.healthcheck.interval=5s
        - traefik.http.services.conveniat27.loadbalancer.healthcheck.timeout=3s

        # Define a middleware for retrying failed requests.
        - traefik.http.middlewares.retry-middleware-prod.retry.attempts=3
        - traefik.http.middlewares.retry-middleware-prod.retry.initialinterval=50ms

      resources:
        limits:
          cpus: '2.0'
          memory: 2048M

    volumes:
      - /cluster/dist_storage_insane/service_data/conveniat-prod/next-cache:/app/.next/cache

    dns:
      - 8.8.8.8 # Replace with your desired DNS server

    depends_on:
      - mongo
      - redis
    env_file:
      - .env

    networks:
      - traefik-net
      - backend-net
      - observability-net

    healthcheck:
      test: ['CMD-SHELL', 'curl -fs http://localhost:3000/status | grep -q "status\":\"ok"']
      interval: 5s
      timeout: 3s
      retries: 3
      start_period: 10s

  mongo:
    image: mongo:latest
    command:
      - --storageEngine=wiredTiger
    volumes:
      - /cluster/dist_storage_insane/service_data/conveniat-prod/mongodb-data:/data/db
    logging:
      driver: none

    networks:
      - backend-net

  mongo-backup:
    image: mongo:latest
    depends_on:
      - mongo
    networks:
      - backend-net
    volumes:
      - /cluster/dist_storage_insane/service_data/conveniat-prod/mongodb-data-backup-dumps:/backup
    command: >
      sh -c '
        while true; do
          echo "INFO: 🧹 Deleting backups older than 30 days...";
          find /backup -type d -mtime +30 -exec rm -rf {} +;
          echo "INFO: Creating database backup...";
          mongodump --host mongo --out /backup/dump_$$$$(date +%Y-%m-%d_%H-%M-%S);
          echo "INFO: Backup complete. Waiting 1 hour.";
          sleep 3600; # 1 hour
        done
      '

  minio:
    image: minio/minio

    deploy:
      labels:
        - swarmpit.service.deployment.autoredeploy=true
        - traefik.enable=true

        - traefik.http.routers.conveniat-minio-router-http.rule=Host(`minio.conveniat27.ch`)
        - traefik.http.routers.conveniat-minio-router-http.entrypoints=web
        - traefik.http.routers.conveniat-minio-router-http.middlewares=redirect-to-https@file

        - traefik.http.routers.conveniat-minio-router-console-http.rule=Host(`console-minio.conveniat27.ch`)
        - traefik.http.routers.conveniat-minio-router-console-http.entrypoints=web
        - traefik.http.routers.conveniat-minio-router-console-http.middlewares=redirect-to-https@file

        - traefik.http.routers.conveniat-minio-router.rule=Host(`minio.conveniat27.ch`)
        - traefik.http.routers.conveniat-minio-router.entrypoints=websecure
        - traefik.http.routers.conveniat-minio-router.service=conveniat-minio

        - traefik.http.routers.conveniat-console-minio-router.rule=Host(`console-minio.conveniat27.ch`)
        - traefik.http.routers.conveniat-console-minio-router.entrypoints=websecure
        - traefik.http.routers.conveniat-console-minio-router.service=conveniat-console-minio

        - traefik.http.services.conveniat-minio.loadbalancer.server.port=9000
        - traefik.http.services.conveniat-console-minio.loadbalancer.server.port=9001

    command: server --console-address ":9001" /data

    env_file:
      - .env

    volumes:
      - /cluster/dist_storage_insane/service_data/conveniat-prod/minio-data:/data

    networks:
      - traefik-net
      - backend-net

  postgres:
    image: postgres:17

    env_file:
      - .env

    volumes:
      - /cluster/dist_storage_insane/service_data/conveniat-prod/postgres:/var/lib/postgresql/data

    networks:
      - backend-net

  tempo:
    user: '0:0'
    image: grafana/tempo:latest
    command: ['-config.file=/etc/tempo/tempo.yml']
    volumes:
      - /cluster/dist_storage_insane/service_data/conveniat-prod/tempo:/tmp/tempo
    configs:
      - source: tempo-config
        target: /etc/tempo/tempo.yml
    networks:
      - observability-net

  loki:
    image: grafana/loki
    volumes:
      - /cluster/dist_storage_insane/service_data/conveniat-prod/loki:/loki
    command:
      - --config.file=/mnt/config/loki-config.yml
    configs:
      - source: loki-config
        target: /mnt/config/loki-config.yml
    networks:
      - observability-net

  redis:
    image: redis:alpine
    networks:
      - backend-net
    volumes:
      - /cluster/dist_storage_insane/service_data/conveniat-prod/redis:/data
    logging:
      driver: none
    deploy:
      replicas: 1

configs:
  loki-config:
    name: loki_config_conveniat_dev-${STAMP:-0}
    file: /cluster/swarm/configs/conveniat27/loki/loki-config.yml

  tempo-config:
    name: tempo_config_conveniat_dev-${STAMP:-0}
    file: /cluster/swarm/configs/conveniat27/tempo/tempo.yml

networks:
  traefik-net:
    external: true

  backend-net:
    driver: overlay
    attachable: true

  observability-net:
    driver: overlay
    attachable: true