photoplaces/deploy/docker-compose.prod.yml

version: "3.9"

x-common: &common
  restart: unless-stopped
  networks:
    - photoplaces

# Secrets for Docker Swarm mode (optional, ignored in compose)
x-secrets: &secrets
  db_password:
    external: true
  redis_password:
    external: true
  jwt_secret:
    external: true
  jwt_refresh_secret:
    external: true
  s3_secret_key:
    external: true

services:
  caddy:
    <<: *common
    image: caddy:2.8-alpine
    ports:
      - "80:80"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
      - caddy_config:/config
    environment:
      DOMAIN: ${DOMAIN}
    depends_on:
      backend:
        condition: service_healthy
      frontend:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:2019/metrics"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  postgres:
    <<: *common
    image: postgis/postgis:16-3.4-alpine
    environment:
      POSTGRES_DB: photoplaces
      POSTGRES_USER: photoplaces
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U photoplaces"]
      interval: 10s
      retries: 5
    secrets:
      - db_password

  redis:
    <<: *common
    image: redis:7-alpine
    command: redis-server --requirepass-file /run/secrets/redis_password
    volumes:
      - redisdata:/data
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "$(cat /run/secrets/redis_password)", "ping"]
      interval: 10s
      retries: 5
    secrets:
      - redis_password

  minio:
    <<: *common
    image: minio/minio:latest
    command: server /data --console-address ":9001"
    volumes:
      - miniodata:/data
    environment:
      MINIO_ROOT_USER: ${S3_ACCESS_KEY}
      MINIO_ROOT_PASSWORD_FILE: /run/secrets/s3_secret_key
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 10s
      retries: 5
    secrets:
      - s3_secret_key
    # Порты 9000/9001 ТОЛЬКО внутри Docker сети (нет внешнего доступа)

  backend:
    <<: *common
    build:
      context: ./backend
      dockerfile: Dockerfile
    env_file:
      - ./env.prod
    environment:
      APP_ENV: production
      SERVER_PORT: "8080"
      DATABASE_URL: postgres://photoplaces:$(cat /run/secrets/db_password)@postgres:5432/photoplaces?sslmode=disable
      REDIS_URL: redis://:$(cat /run/secrets/redis_password)@redis:6379/0
      S3_ENDPOINT: http://minio:9000
      S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT}
      S3_ACCESS_KEY: ${S3_ACCESS_KEY}
      S3_SECRET_KEY_FILE: /run/secrets/s3_secret_key
      S3_BUCKET: photoplaces
      JWT_SECRET_FILE: /run/secrets/jwt_secret
      JWT_REFRESH_SECRET_FILE: /run/secrets/jwt_refresh_secret
      CLOUDPAYMENTS_PUBLIC_ID: ${CLOUDPAYMENTS_PUBLIC_ID}
      CLOUDPAYMENTS_API_SECRET: ${CLOUDPAYMENTS_API_SECRET}
      ALLOWED_ORIGINS: ${ALLOWED_ORIGINS}
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/api/v1/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    secrets:
      - db_password
      - redis_password
      - jwt_secret
      - jwt_refresh_secret
      - s3_secret_key

  frontend:
    <<: *common
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
        NEXT_PUBLIC_MAP_PROVIDER: yandex
        NEXT_PUBLIC_YANDEX_MAPS_API_KEY: ${YANDEX_MAPS_API_KEY}
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:3000"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

volumes:
  pgdata:
  redisdata:
  miniodata:
  caddy_data:
  caddy_config:

networks:
  photoplaces:

secrets:
  db_password:
    external: true
  redis_password:
    external: true
  jwt_secret:
    external: true
  jwt_refresh_secret:
    external: true
  s3_secret_key:
    external: true