docker-compose.prod.yml

# Production Docker Compose
# Usage: create an env file (variable table in docs/operate/deployment.md),
# then: docker compose -f docker-compose.prod.yml --env-file <your-env> up -d --build
#
# Task 37: services reference the versioned ghcr images published by
# release.yml (set FULLA_VERSION to pin; `--build` still works and tags
# the local build with the same name). Schema migrations run through the
# one-shot `migrate` service (profile "migrate"), not at app startup:
#   docker compose -f docker-compose.prod.yml --env-file <your-env> \
#     --profile migrate run --rm --build migrate
# The app itself keeps FULLA_AUTO_MIGRATE=false and only self-checks.
# NOTE: the migrate service also carries a build: section so a fresh
# deployment can migrate from LOCAL sources with --build even when the
# released ghcr image is unavailable (mirrored/offline hosts) or stale
# relative to unreleased migrations — the WSL 2026-09-12 rehearsal hit
# exactly that: `run --rm migrate` pulled the released image and silently
# applied one migration fewer than the local sources ship.

services:
  nginx:
    image: nginx:stable-alpine
    container_name: oauth2-nginx
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ../../deploy/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ../../deploy/nginx/ssl:/etc/nginx/ssl:ro
    depends_on:
      fulla-backend:
        condition: service_healthy
      fulla-frontend:
        condition: service_started
      fulla-admin:
        condition: service_started
    networks:
      - oauth2-net

  fulla-frontend:
    image: ghcr.io/voidvec/fulla-frontend:${FULLA_VERSION:-latest}
    build:
      context: ../..
      dockerfile: deploy/docker/Dockerfile
      target: frontend-runtime
      args:
        # Vite build-time vars (inlined into the SPA bundle)
        VITE_API_BASE_URL: ${VITE_API_BASE_URL:-}
        VITE_CLIENT_ID: ${VITE_CLIENT_ID:-fulla-portal}
        VITE_REDIRECT_URI: ${VITE_REDIRECT_URI:-}
    container_name: fulla-frontend
    restart: always
    expose:
      - "80"
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 128M
    networks:
      - oauth2-net

  fulla-admin:
    image: ghcr.io/voidvec/fulla-admin:${FULLA_VERSION:-latest}
    build:
      context: ../../frontends/admin
      dockerfile: Dockerfile
    container_name: fulla-admin
    restart: always
    expose:
      - "80"
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 128M
    networks:
      - oauth2-net

  fulla-backend:
    image: ghcr.io/voidvec/fulla-backend:${FULLA_VERSION:-latest}
    build:
      context: ../..
      dockerfile: deploy/docker/Dockerfile
      target: backend-runtime
    container_name: fulla-backend
    restart: always
    expose:
      - "5555"
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: 512M
    depends_on:
      fulla-postgres:
        condition: service_healthy
      fulla-redis:
        condition: service_started
    environment:
      - FULLA_ENV=${FULLA_ENV:-production}
      - FULLA_ISSUER=${FULLA_ISSUER}
      - FULLA_JWT_KEY_PATH=${FULLA_JWT_KEY_PATH:-/app/keys/signing.pem}
      - FULLA_DB_HOST=${FULLA_DB_HOST}
      - FULLA_DB_PORT=${FULLA_DB_PORT:-5432}
      - FULLA_DB_NAME=${FULLA_DB_NAME}
      - FULLA_DB_USER=${FULLA_DB_USER}
      - FULLA_DB_PASSWORD=${FULLA_DB_PASSWORD}
      - FULLA_REDIS_HOST=${FULLA_REDIS_HOST}
      - FULLA_REDIS_PORT=${FULLA_REDIS_PORT:-6379}
      - FULLA_REDIS_PASSWORD=${FULLA_REDIS_PASSWORD}
      - FULLA_LISTEN_PORT=${FULLA_LISTEN_PORT:-5555}
      - FULLA_FRONTEND_URL=${FULLA_FRONTEND_URL}
      - FULLA_CORS_ALLOW_ORIGINS=${FULLA_CORS_ALLOW_ORIGINS}
      - FULLA_PORTAL_REDIRECT_URI=${FULLA_PORTAL_REDIRECT_URI}
      - FULLA_PORTAL_CLIENT_SECRET=${FULLA_PORTAL_CLIENT_SECRET}
      - FULLA_ADMIN_CONSOLE_REDIRECT_URI=${FULLA_ADMIN_CONSOLE_REDIRECT_URI}
      # WebAuthn / passkeys (#142): fail-closed while RP_ORIGINS is empty
      - FULLA_WEBAUTHN_RP_ID=${FULLA_WEBAUTHN_RP_ID:-}
      - FULLA_WEBAUTHN_RP_NAME=${FULLA_WEBAUTHN_RP_NAME:-Fulla}
      - FULLA_WEBAUTHN_RP_ORIGINS=${FULLA_WEBAUTHN_RP_ORIGINS:-}
      - FULLA_GOOGLE_REDIRECT_URI=${FULLA_GOOGLE_REDIRECT_URI:-}
      # Migrations run via the `migrate` one-shot service (see header);
      # the app only self-checks the schema at startup.
      - FULLA_AUTO_MIGRATE=${FULLA_AUTO_MIGRATE:-false}
      - DETAILED_VALIDATION_ERRORS=${DETAILED_VALIDATION_ERRORS:-false}
      # Optional: set the bootstrap admin's initial password explicitly;
      # when empty AdminBootstrapper generates a random one and prints it
      # ONCE to the container log (read it via `docker compose logs backend`).
      - FULLA_BOOTSTRAP_ADMIN_PASSWORD=${FULLA_BOOTSTRAP_ADMIN_PASSWORD:-}
      # External auth (optional)
      - FULLA_GITHUB_CLIENT_ID=${FULLA_GITHUB_CLIENT_ID:-}
      - FULLA_GITHUB_CLIENT_SECRET=${FULLA_GITHUB_CLIENT_SECRET:-}
      - FULLA_GOOGLE_CLIENT_ID=${FULLA_GOOGLE_CLIENT_ID:-}
      - FULLA_GOOGLE_CLIENT_SECRET=${FULLA_GOOGLE_CLIENT_SECRET:-}
      # WeChat OAuth (optional)
      - FULLA_WECHAT_APPID=${FULLA_WECHAT_APPID:-}
      - FULLA_WECHAT_SECRET=${FULLA_WECHAT_SECRET:-}
      # Email / SMTP (生产环境必须配置，否则验证邮件/密码重置只输出到日志)
      - FULLA_SMTP_HOST=${FULLA_SMTP_HOST:-}
      - FULLA_SMTP_PORT=${FULLA_SMTP_PORT:-465}
      - FULLA_SMTP_USER=${FULLA_SMTP_USER:-}
      - FULLA_SMTP_PASSWORD=${FULLA_SMTP_PASSWORD:-}
      - FULLA_SMTP_FROM_NAME=${FULLA_SMTP_FROM_NAME:-OAuth2 Platform}
      - FULLA_SMTP_SSL=${FULLA_SMTP_SSL:-true}
    volumes:
      - ../../deploy/keys:/app/keys:ro
      # migrations/seed are baked into the image (/app/sql/*) -- no volume
      # mounts, so the running container matches the released artifact.
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5555/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    networks:
      - oauth2-net

  # One-shot schema migration executor (Task 37). Not started by default:
  #   docker compose -f docker-compose.prod.yml --env-file .env.docker \
  #     --profile migrate run --rm --build migrate
  # (--build migrates from LOCAL sources; without it compose pulls the
  # released image, which may predate unreleased migrations.)
  # Exit code 0 = schema up to date, 1 = failure (compose surfaces it).
  migrate:
    image: ghcr.io/voidvec/fulla-backend:${FULLA_VERSION:-latest}
    build:
      context: ../..
      dockerfile: deploy/docker/Dockerfile
      target: backend-runtime
    profiles: ["migrate"]
    command: ["./fulla-server", "--migrate-only"]
    restart: "no"
    depends_on:
      fulla-postgres:
        condition: service_healthy
    environment:
      - FULLA_ENV=${FULLA_ENV:-production}
      - FULLA_ISSUER=${FULLA_ISSUER}
      - FULLA_JWT_KEY_PATH=${FULLA_JWT_KEY_PATH:-/app/keys/signing.pem}
      - FULLA_DB_HOST=${FULLA_DB_HOST}
      - FULLA_DB_PORT=${FULLA_DB_PORT:-5432}
      - FULLA_DB_NAME=${FULLA_DB_NAME}
      - FULLA_DB_USER=${FULLA_DB_USER}
      - FULLA_DB_PASSWORD=${FULLA_DB_PASSWORD}
      - FULLA_REDIS_HOST=${FULLA_REDIS_HOST}
      - FULLA_REDIS_PORT=${FULLA_REDIS_PORT:-6379}
      - FULLA_REDIS_PASSWORD=${FULLA_REDIS_PASSWORD}
      - FULLA_PORTAL_CLIENT_SECRET=${FULLA_PORTAL_CLIENT_SECRET}
    volumes:
      - ../../deploy/keys:/app/keys:ro
    networks:
      - oauth2-net

  fulla-postgres:
    image: postgres:17-alpine
    container_name: fulla-postgres
    restart: always
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
    volumes:
      - pgdata:/var/lib/postgresql/data
    networks:
      - oauth2-net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 5

  fulla-redis:
    image: redis:7-alpine
    container_name: fulla-redis
    restart: always
    command: redis-server --requirepass ${REDIS_PASSWORD}
    volumes:
      - redisdata:/data
    networks:
      - oauth2-net

  fulla-prometheus:
    image: prom/prometheus:latest
    container_name: fulla-prometheus
    restart: always
    ports:
      # Loopback only: reach it via SSH tunnel / reverse proxy, never the
      # public interface.
      - "127.0.0.1:9090:9090"
    volumes:
      - ../observability/prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - promdata:/prometheus
    networks:
      - oauth2-net

networks:
  oauth2-net:
    driver: bridge

volumes:
  pgdata:
  redisdata:
  promdata: