docker-compose.yml

name: hayon

services:
  # ============================================================
  # Nginx — reverse proxy + TLS termination
  # ============================================================
  nginx:
    image: nginx:1.27-alpine
    container_name: hayon_nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./certbot/conf:/etc/letsencrypt:ro
      - ./certbot/www:/var/www/certbot:ro
    depends_on:
      - frontend
      - backend
    restart: unless-stopped
    networks:
      - hayon_net
    deploy:
      resources:
        limits:
          memory: 64M

  # ============================================================
  # Certbot — SSL renewal daemon
  # ============================================================
  certbot:
    image: certbot/certbot:latest
    container_name: hayon_certbot
    volumes:
      - ./certbot/conf:/etc/letsencrypt
      - ./certbot/www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
    networks:
      - hayon_net

  # ============================================================
  # Frontend — Next.js standalone
  # ============================================================
  frontend:
    build:
      context: .
      dockerfile: frontend/Dockerfile
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
        NEXT_PUBLIC_VAPID_KEY: ${NEXT_PUBLIC_VAPID_KEY}
        NEXT_PUBLIC_FIREBASE_API_KEY: ${NEXT_PUBLIC_FIREBASE_API_KEY}
        NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: ${NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN}
        NEXT_PUBLIC_FIREBASE_PROJECT_ID: ${NEXT_PUBLIC_FIREBASE_PROJECT_ID}
        NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: ${NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET}
        NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: ${NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID}
        NEXT_PUBLIC_FIREBASE_APP_ID: ${NEXT_PUBLIC_FIREBASE_APP_ID}
        NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID: ${NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID}
        NEXT_PUBLIC_POSTHOG_KEY: ${NEXT_PUBLIC_POSTHOG_KEY}
        NEXT_PUBLIC_POSTHOG_HOST: ${NEXT_PUBLIC_POSTHOG_HOST}
    container_name: hayon_frontend
    expose:
      - "3000"
    environment:
      - NODE_ENV=production
      - PORT=3000
      - HOSTNAME=0.0.0.0
    restart: unless-stopped
    networks:
      - hayon_net
    deploy:
      resources:
        limits:
          memory: 256M

  # ============================================================
  # Backend — Express API
  # ============================================================
  backend:
    build:
      context: .
      dockerfile: backend/Dockerfile
    container_name: hayon_backend
    expose:
      - "5000"
    env_file:
      - backend/.env
    environment:
      - NODE_ENV=production
      - RABBITMQ_URL=amqp://${RABBITMQ_USER:-hayon}:${RABBITMQ_PASS:-hayon_secret}@rabbitmq:5672
      - REDIS_HOST=redis
      - REDIS_PORT=6379
    depends_on:
      rabbitmq:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - hayon_net
    deploy:
      resources:
        limits:
          memory: 256M

  # ============================================================
  # Worker — RabbitMQ consumer (same image, different CMD)
  # ============================================================
  worker:
    build:
      context: .
      dockerfile: backend/Dockerfile
    container_name: hayon_worker
    command: ["node", "dist/workers/index.js"]
    env_file:
      - backend/.env
    environment:
      - NODE_ENV=production
      - RABBITMQ_URL=amqp://${RABBITMQ_USER:-hayon}:${RABBITMQ_PASS:-hayon_secret}@rabbitmq:5672
      - REDIS_HOST=redis
      - REDIS_PORT=6379
    depends_on:
      rabbitmq:
        condition: service_healthy
      redis:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - hayon_net
    deploy:
      resources:
        limits:
          memory: 200M

  # ============================================================
  # Redis — cache
  # ============================================================
  redis:
    image: redis:7-alpine
    container_name: hayon_redis
    expose:
      - "6379"
    volumes:
      - redis_data:/data
    # maxmemory 100mb: prevents Redis from eating all RAM on t2.micro
    # allkeys-lru: evict least-recently-used keys when memory is full
    command: redis-server --appendonly yes --maxmemory 100mb --maxmemory-policy allkeys-lru
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - hayon_net
    deploy:
      resources:
        limits:
          memory: 128M

  # ============================================================
  # RabbitMQ — message broker (with delayed message plugin)
  # ============================================================
  rabbitmq:
    build:
      context: ./rabbitmq
      dockerfile: Dockerfile
    container_name: hayon_rabbitmq
    expose:
      - "5672"
    ports:
      # Management UI — only accessible locally via SSH tunnel
      - "127.0.0.1:15672:15672"
    volumes:
      - rabbitmq_data:/var/lib/rabbitmq
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_USER:-hayon}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASS:-hayon_secret}
      # Limit memory usage — important for t2.micro
      RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS: "-rabbit vm_memory_high_watermark 0.4"
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "ping"]
      interval: 15s
      timeout: 10s
      retries: 10
      start_period: 30s
    restart: unless-stopped
    networks:
      - hayon_net
    deploy:
      resources:
        limits:
          memory: 256M

volumes:
  redis_data:
  rabbitmq_data:

networks:
  hayon_net:
    driver: bridge