# =============================================================================
# Realms Production Docker Compose
# =============================================================================
# Uses pre-built images from Forgejo registry (qbit.realms.pub)
# Deployed to /opt/realms/ on production server
# =============================================================================

services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: streaming
      POSTGRES_USER: streamuser
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U streamuser -d streaming"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend

  ovenmediaengine:
    image: airensoft/ovenmediaengine:latest
    restart: unless-stopped
    ports:
      - "1935:1935"           # RTMP
      - "9999:9999/udp"       # SRT
      # WebRTC Signaling (3333/3334) now proxied through nginx
      - "3478:3478"           # STUN/TURN for NAT traversal
      - "10000-10009:10000-10009/udp" # WebRTC ICE Candidates
    volumes:
      - ./Server.xml:/opt/ovenmediaengine/bin/origin_conf/Server.xml
      - ome_logs:/var/log/ovenmediaengine
    environment:
      OME_API_PORT: 8081
      OME_API_ACCESS_TOKEN: ${OME_API_TOKEN}
    networks:
      - backend
      - frontend

  drogon-backend:
    image: qbit.realms.pub/doomtube/beeta/backend:latest
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      DB_HOST: postgres
      DB_NAME: streaming
      DB_USER: streamuser
      DB_PASS: ${DB_PASSWORD}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_DB: 1
      REDIS_PASS: ${REDIS_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
      OME_API_URL: http://ovenmediaengine:8081
      OME_API_TOKEN: ${OME_API_TOKEN}
    volumes:
      - ./config.json:/app/config.json
      - uploads:/app/uploads
      - /etc/letsencrypt:/etc/letsencrypt:ro
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/health"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - backend

  chat-service:
    image: qbit.realms.pub/doomtube/beeta/chat-service:latest
    restart: unless-stopped
    depends_on:
      redis:
        condition: service_healthy
      drogon-backend:
        condition: service_healthy
    environment:
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_DB: 1
      REDIS_PASS: ${REDIS_PASSWORD}
      JWT_SECRET: ${JWT_SECRET}
    # Config is baked into the Docker image
    healthcheck:
      test: ["CMD-SHELL", "curl -s http://localhost:8081/ > /dev/null 2>&1 || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - backend

  nakama:
    image: qbit.realms.pub/doomtube/beeta/nakama:latest
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    entrypoint:
      - "/bin/sh"
      - "-c"
      - |
        set -e
        apt-get update >/dev/null 2>&1 && apt-get install -y postgresql-client >/dev/null 2>&1 || true
        PGPASSWORD=$DB_PASSWORD psql -h postgres -U streamuser -d postgres -tc "SELECT 1 FROM pg_database WHERE datname = 'nakama'" | grep -q 1 || PGPASSWORD=$DB_PASSWORD psql -h postgres -U streamuser -d postgres -c "CREATE DATABASE nakama"
        /nakama/nakama migrate up --database.address "streamuser:$DB_PASSWORD@postgres:5432/nakama?sslmode=disable"
        exec /nakama/nakama \
          --name realms-nakama \
          --database.address "streamuser:$DB_PASSWORD@postgres:5432/nakama?sslmode=disable" \
          --socket.server_key "$NAKAMA_SERVER_KEY" \
          --session.token_expiry_sec 86400 \
          --runtime.env "JWT_SECRET=$JWT_SECRET" \
          --console.username admin \
          --console.password "$NAKAMA_CONSOLE_PASSWORD" \
          --logger.level INFO
    environment:
      - JWT_SECRET=${JWT_SECRET}
      - NAKAMA_CONSOLE_PASSWORD=${NAKAMA_CONSOLE_PASSWORD}
      - NAKAMA_SERVER_KEY=${NAKAMA_SERVER_KEY}
      - DB_PASSWORD=${DB_PASSWORD}
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:7350/healthcheck"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    networks:
      - backend
      - frontend

  openresty:
    image: qbit.realms.pub/doomtube/beeta/openresty:latest
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8088:8088"           # HLS/LLHLS proxy with CORS
    depends_on:
      drogon-backend:
        condition: service_healthy
      chat-service:
        condition: service_healthy
      ovenmediaengine:
        condition: service_started
      redis:
        condition: service_healthy
      nakama:
        condition: service_started
    environment:
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_DB: 1
      REDIS_PASS: ${REDIS_PASSWORD}
      BACKEND_URL: http://drogon-backend:8080
      CHAT_URL: http://chat-service:8081
      OME_URL: http://ovenmediaengine:8081
      JWT_SECRET: ${JWT_SECRET}
    volumes:
      - uploads:/app/uploads:ro
      - /etc/letsencrypt:/etc/letsencrypt:ro
      - certbot_webroot:/var/www/certbot:ro
    networks:
      - frontend
      - backend

  sveltekit:
    image: qbit.realms.pub/doomtube/beeta/frontend:latest
    restart: unless-stopped
    depends_on:
      openresty:
        condition: service_started
    environment:
      NODE_ENV: production
    networks:
      - frontend

  certbot:
    image: certbot/certbot:latest
    restart: unless-stopped
    volumes:
      - /etc/letsencrypt:/etc/letsencrypt
      - certbot_webroot:/var/www/certbot
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        trap exit TERM
        while :; do
          certbot renew --webroot --webroot-path=/var/www/certbot --quiet
          sleep 12h & wait $$!
        done
    networks:
      - backend

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge

volumes:
  postgres_data:
  redis_data:
  ome_logs:
  uploads:
  certbot_webroot: