docker-compose.prod.yml

# PRODUCTION — Docker Compose Stack pour Coolify.
# Toutes les variables ${...} sont configurées dans l'interface Coolify.
# Aucune URL de domaine n'est codée en dur dans ce fichier.
#
# Adresses réseau Docker internes (http://api:8080, http://meilisearch:7700)
# et constantes techniques (SERVER_HOST, S3_REGION, etc.) peuvent rester
# hardcodées car elles ne dépendent pas de l'environnement de déploiement.

services:

  # ── Frontend Next.js ──────────────────────────────────────────────────────
  frontend:
    container_name: pumpkin-hub-frontend
    image: ghcr.io/fablrc/pumpkin-hub-frontend:latest
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      # Réseau Docker interne — valeur fixe, toujours correcte dans ce compose
      - NEXT_INTERNAL_API_URL=http://api:8080
      # CONTRAT CSP : ces trois variables doivent avoir les mêmes valeurs que
      # les secrets GitHub utilisés comme build-args dans docker.yml.
      # Toute divergence provoque des violations CSP en production.
      - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
      - NEXT_PUBLIC_S3_PUBLIC_URL=${NEXT_PUBLIC_S3_PUBLIC_URL}
      - NEXT_PUBLIC_S3_PRESIGNED_ORIGIN=${NEXT_PUBLIC_S3_PRESIGNED_ORIGIN}
    depends_on:
      api:
        condition: service_healthy

  # ── API Rust / Axum ───────────────────────────────────────────────────────
  api:
    container_name: pumpkin-hub-api
    image: ghcr.io/fablrc/pumpkin-hub-api:latest
    restart: unless-stopped
    ports:
      - "8082:8080"
    environment:
      # -- Serveur --
      - SERVER_HOST=0.0.0.0
      - SERVER_PORT=8080
      - API_PUBLIC_URL=${API_PUBLIC_URL}
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS}
      - COOKIE_SECURE=true
      - COOKIE_DOMAIN=${COOKIE_DOMAIN}

      # -- Base de données --
      - DATABASE_URL=postgres://${POSTGRES_USER:-pumpkin}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-pumpkin_hub}

      # -- Meilisearch (réseau Docker interne) --
      - MEILISEARCH_URL=http://meilisearch:7700
      - MEILISEARCH_KEY=${MEILISEARCH_KEY}

      # -- Auth --
      - JWT_SECRET=${JWT_SECRET}
      - JWT_TTL_SECONDS=86400

      # -- OAuth GitHub (obligatoire) --
      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID}
      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET}
      # API_PUBLIC_URL ne doit pas avoir de slash final
      - GITHUB_REDIRECT_URI=${API_PUBLIC_URL}/api/v1/auth/github/callback

      # -- OAuth Discord (optionnel) --
      - DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID:-}
      - DISCORD_CLIENT_SECRET=${DISCORD_CLIENT_SECRET:-}
      - DISCORD_REDIRECT_URI=${API_PUBLIC_URL}/api/v1/auth/discord/callback

      # -- OAuth Google (optionnel) --
      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-}
      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
      - GOOGLE_REDIRECT_URI=${API_PUBLIC_URL}/api/v1/auth/google/callback

      # -- Cloudflare R2 (S3-compatible) --
      - S3_ENDPOINT_URL=https://${R2_ACCOUNT_ID}.r2.cloudflarestorage.com
      - S3_ACCESS_KEY_ID=${R2_ACCESS_KEY_ID}
      - S3_SECRET_ACCESS_KEY=${R2_SECRET_ACCESS_KEY}
      - S3_BUCKET=${R2_BUCKET:-pumpkin-hub-binaries}
      - S3_REGION=auto
      - S3_FORCE_PATH_STYLE=false
      # Réutilise la même variable que le frontend (même domaine R2)
      - S3_PUBLIC_URL=${NEXT_PUBLIC_S3_PUBLIC_URL}
      - S3_USE_DIRECT_URLS=true

      # -- SMTP --
      - SMTP_HOST=${SMTP_HOST}
      - SMTP_PORT=${SMTP_PORT:-465}
      - SMTP_USERNAME=${SMTP_USERNAME}
      - SMTP_PASSWORD=${SMTP_PASSWORD}
      - SMTP_FROM_ADDRESS=${SMTP_FROM_ADDRESS}

      # -- Limites et logs --
      - BINARY_MAX_SIZE_BYTES=104857600
      - RUST_LOG=pumpkin_hub_api=info,tower_http=info

      # -- GitHub App (optionnel) --
      - GITHUB_APP_ID=${GITHUB_APP_ID:-}
      - GITHUB_APP_PRIVATE_KEY=${GITHUB_APP_PRIVATE_KEY:-}
      - GITHUB_APP_WEBHOOK_SECRET=${GITHUB_APP_WEBHOOK_SECRET:-}
    depends_on:
      db:
        condition: service_healthy
      meilisearch:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/v1/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

  # ── PostgreSQL 16 ─────────────────────────────────────────────────────────
  db:
    container_name: pumpkin-hub-db
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-pumpkin}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB:-pumpkin_hub}
    volumes:
      - db-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-pumpkin} -d ${POSTGRES_DB:-pumpkin_hub}"]
      interval: 10s
      timeout: 5s
      retries: 5

  # ── Meilisearch 1.7 ───────────────────────────────────────────────────────
  meilisearch:
    container_name: pumpkin-hub-meilisearch
    image: getmeili/meilisearch:v1.7
    restart: unless-stopped
    environment:
      - MEILI_ENV=production
      - MEILI_MASTER_KEY=${MEILISEARCH_KEY}
    volumes:
      - meili-data:/meili_data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:7700/health"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  db-data:
  meili-data: