docker-compose.prod.yml

# ════════════════════════════════════════════════════════════════════════
# ⚠️  DEPRECATED — schedule cutover by 2026-08-01
# ════════════════════════════════════════════════════════════════════════
#
# This stack is being replaced by the platform's native module-based
# deployment (Golden Eclipse P8 dogfooding milestone). The same logical
# services (postgres, redis, rails, sidekiq, frontend, traefik) now ship
# as `powernode-*` modules under extensions/system/modules/ and are
# orchestrated by the on-node Go agent via systemd unit files generated
# from system_module_services rows.
#
# Cutover runbook: extensions/system/docs/runbooks/docker-compose-cutover.md
#
# Why the cutover:
#   - Single deployment path for self-host AND federated peers
#   - mTLS + cosign-signed supply chain instead of mutable image tags
#   - composefs immutable rootfs + fs-verity at file open
#   - Service lifecycle managed by systemd (Restart, journalctl, etc.)
#     instead of Docker's restart loops
#
# Status as of P8.5: this file remains the supported production path
# until the cutover runbook's acceptance gate (full E2E suite on a
# QEMU-hosted powernode-hub + HA failover <60s) passes. After that
# this file is read-only, archived, and removed in a follow-up cleanup
# release.
#
# Usage during the deprecation window: docker-compose -f docker-compose.prod.yml up -d
# ════════════════════════════════════════════════════════════════════════

services:
  # PostgreSQL Database
  postgres:
    image: postgres:16-alpine
    container_name: powernode-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - powernode-internal

  # Redis for Sidekiq and caching
  redis:
    image: redis:7-alpine
    container_name: powernode-redis
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - powernode-internal

  # Rails API Backend
  backend:
    build:
      context: ./server
      dockerfile: Dockerfile
      target: production
    container_name: powernode-backend
    environment:
      RAILS_ENV: production
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
      SECRET_KEY_BASE: ${SECRET_KEY_BASE}
      JWT_SECRET: ${JWT_SECRET}
      WORKER_API_KEY: ${WORKER_API_KEY}
      STRIPE_API_KEY: ${STRIPE_API_KEY}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET}
      PAYPAL_CLIENT_ID: ${PAYPAL_CLIENT_ID}
      PAYPAL_CLIENT_SECRET: ${PAYPAL_CLIENT_SECRET}
      RAILS_LOG_TO_STDOUT: "true"
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - powernode-internal
      - powernode-external
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.backend.rule=Host(`api.${DOMAIN}`)"
      - "traefik.http.routers.backend.tls=true"
      - "traefik.http.routers.backend.tls.certresolver=letsencrypt"
      - "traefik.http.services.backend.loadbalancer.server.port=3000"

  # Sidekiq Worker
  worker:
    build:
      context: ./worker
      dockerfile: Dockerfile
      target: production
    container_name: powernode-worker
    environment:
      REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379/0
      BACKEND_API_URL: http://backend:3000
      WORKER_API_KEY: ${WORKER_API_KEY}
      STRIPE_API_KEY: ${STRIPE_API_KEY}
      PAYPAL_CLIENT_ID: ${PAYPAL_CLIENT_ID}
      PAYPAL_CLIENT_SECRET: ${PAYPAL_CLIENT_SECRET}
    restart: unless-stopped
    depends_on:
      - backend
      - redis
    networks:
      - powernode-internal

  # React Frontend
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        VITE_API_URL: https://api.${DOMAIN}
        VITE_WS_URL: wss://api.${DOMAIN}
    container_name: powernode-frontend
    restart: unless-stopped
    depends_on:
      - backend
    networks:
      - powernode-external
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.frontend.rule=Host(`${DOMAIN}`) || Host(`www.${DOMAIN}`)"
      - "traefik.http.routers.frontend.tls=true"
      - "traefik.http.routers.frontend.tls.certresolver=letsencrypt"
      - "traefik.http.services.frontend.loadbalancer.server.port=80"

  # Traefik Reverse Proxy
  traefik:
    image: traefik:v3.0
    container_name: powernode-traefik
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_letsencrypt:/letsencrypt
    restart: unless-stopped
    networks:
      - powernode-external
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.rule=Host(`traefik.${DOMAIN}`)"
      - "traefik.http.routers.traefik.tls=true"
      - "traefik.http.routers.traefik.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik.service=api@internal"
      - "traefik.http.routers.traefik.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_AUTH}"

volumes:
  postgres_data:
  redis_data:
  traefik_letsencrypt:

networks:
  powernode-internal:
    driver: bridge
  powernode-external:
    driver: bridge