# =============================================
# website-tuvi — Production deployment
# Targets LXC 192.168.40.22 with host network mode
# (LXC unprivileged containers can't write sysctl,
#  so port mapping fails — use host network instead)
# =============================================
# Run: docker compose -f docker-compose.prod.yml up -d
#
# Required env file (.env.prod) at deploy:
#   DATABASE_URL, REDIS_URL, NEXTAUTH_URL, NEXTAUTH_SECRET, OPENAI_API_KEY...

services:
  app:
    image: website-tuvi:latest
    container_name: tuvi-app
    restart: unless-stopped
    network_mode: host
    privileged: true
    env_file:
      - .env.prod
    environment:
      NODE_ENV: production
      PORT: 3000
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:3000/api/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s

  postgres:
    image: postgres:16-alpine
    container_name: tuvi-postgres
    restart: unless-stopped
    network_mode: host
    privileged: true
    env_file:
      - .env.prod
    environment:
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
      - ./backups:/backups

  redis:
    image: redis:7-alpine
    container_name: tuvi-redis
    restart: unless-stopped
    network_mode: host
    privileged: true
    env_file:
      - .env.prod
    command: >
      sh -c 'redis-server
        --requirepass "$$REDIS_PASSWORD"
        --maxmemory 256mb
        --maxmemory-policy allkeys-lru
        --appendonly yes'
    volumes:
      - ./data/redis:/data
