docker-compose.yml

# docker-compose.yml  Pushpaka production stack
# Requires: Docker Engine 24+ with Compose v2 plugin
# Usage:    docker compose up -d --build

networks:
  pushpaka-network:
    external: false
    name: pushpaka-network

volumes:
  postgres-data:
  redis-data:
  traefik-certs:
  pushpaka-deploy:

services:
  # 
  # Traefik  Reverse Proxy & SSL Termination
  # 
  traefik:
    image: traefik:v3.4
    container_name: pushpaka-traefik
    restart: unless-stopped
    command:
      - "--api.dashboard=true"
      - "--api.insecure=false"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=pushpaka-network"
      - "--providers.file.directory=/etc/traefik/dynamic"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.letsencrypt.acme.email=${ACME_EMAIL:-admin@example.com}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/certs/acme.json"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--log.level=INFO"
      - "--accesslog=true"
      - "--metrics.prometheus=true"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certs:/certs
      - ./infrastructure/traefik/dynamic:/etc/traefik/dynamic:ro
    networks:
      - pushpaka-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik-dashboard.rule=Host(`traefik.${DOMAIN:-localhost}`)"
      - "traefik.http.routers.traefik-dashboard.service=api@internal"
      - "traefik.http.routers.traefik-dashboard.entrypoints=websecure"
      - "traefik.http.routers.traefik-dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.traefik-dashboard.middlewares=auth"
      - "traefik.http.middlewares.auth.basicauth.users=${TRAEFIK_AUTH:-admin:$$apr1$$ruca84Hq$$mbjdMZBAG.KWn7XvjLOCl/}"

  # 
  # PostgreSQL Database
  # 
  postgres:
    image: postgres:17-alpine
    container_name: pushpaka-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-pushpaka}
      POSTGRES_USER: ${POSTGRES_USER:-pushpaka}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-pushpaka_secret}
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./migrations:/docker-entrypoint-initdb.d:ro
    networks:
      - pushpaka-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-pushpaka}"]
      interval: 10s
      timeout: 5s
      retries: 5

  # 
  # Redis Queue
  # 
  redis:
    image: redis:8-alpine
    container_name: pushpaka-redis
    restart: unless-stopped
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-redis_secret}
    volumes:
      - redis-data:/data
    networks:
      - pushpaka-network
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-redis_secret}", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  # 
  # Pushpaka  unified binary (API + Worker)
  # Set PUSHPAKA_COMPONENT=api to run API only,
  # PUSHPAKA_COMPONENT=worker for worker-only replicas.
  # 
  pushpaka:
    build:
      context: .
      dockerfile: Dockerfile
    image: pushpaka:latest
    container_name: pushpaka
    restart: unless-stopped
    environment:
      PUSHPAKA_COMPONENT: ${PUSHPAKA_COMPONENT:-all}
      PORT: "8080"
      APP_ENV: ${APP_ENV:-production}
      DATABASE_DRIVER: postgres
      DATABASE_URL: postgres://${POSTGRES_USER:-pushpaka}:${POSTGRES_PASSWORD:-pushpaka_secret}@postgres:5432/${POSTGRES_DB:-pushpaka}?sslmode=disable
      REDIS_URL: redis://:${REDIS_PASSWORD:-redis_secret}@redis:6379
      JWT_SECRET: ${JWT_SECRET:-change-this-in-production-please}
      JWT_EXPIRY_HOURS: ${JWT_EXPIRY_HOURS:-24}
      CORS_ORIGINS: ${CORS_ORIGINS:-https://app.localhost}
      DOCKER_HOST: unix:///var/run/docker.sock
      TRAEFIK_NETWORK: pushpaka-network
      BUILD_CLONE_DIR: /tmp/pushpaka-builds
      BUILD_DEPLOY_DIR: /deploy/pushpaka
      BUILD_WORKERS: ${BUILD_WORKERS:-3}
      LOG_LEVEL: ${LOG_LEVEL:-info}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /tmp/pushpaka-builds:/tmp/pushpaka-builds
      - pushpaka-deploy:/deploy/pushpaka
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - pushpaka-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/v1/ready"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 10s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pushpaka-api.rule=Host(`api.${DOMAIN:-localhost}`)"
      - "traefik.http.routers.pushpaka-api.entrypoints=websecure"
      - "traefik.http.routers.pushpaka-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.pushpaka-api.loadbalancer.server.port=8080"

  # 
  # Frontend Dashboard (Next.js 16 static export)
  # 
  pushpaka-dashboard:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    container_name: pushpaka-dashboard
    restart: unless-stopped
    environment:
      NEXT_PUBLIC_API_URL: https://api.${DOMAIN:-localhost}
      NEXT_PUBLIC_WS_URL: wss://api.${DOMAIN:-localhost}
    depends_on:
      pushpaka:
        condition: service_healthy
    networks:
      - pushpaka-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.pushpaka-dashboard.rule=Host(`app.${DOMAIN:-localhost}`)"
      - "traefik.http.routers.pushpaka-dashboard.entrypoints=websecure"
      - "traefik.http.routers.pushpaka-dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.services.pushpaka-dashboard.loadbalancer.server.port=3000"