docker-compose.https.yml

# FTTH-Copilot — Production with HTTPS (Caddy reverse proxy)
#
# Usage:
#   cp .env.example .env.prod
#   # Add to .env.prod:
#   CADDY_DOMAIN=ftth.example.com
#   CADDY_EMAIL=admin@example.com
#   CADDY_HTTP_PORT=80
#   CADDY_HTTPS_PORT=443
#   # Remove or comment out the "ports: - 3001:3001" line from app service
#   docker compose -f docker-compose.https.yml up -d
#
# Caddy automatically provisions Let's Encrypt certificates.
# No manual certificate management required.
#
# This compose is standalone: it brings its own Postgres, Redis, web and
# worker. The worker is part of the stack, not an option — the web only
# serves HTTP, so a deployment without a worker is a deployment that polls
# nothing, receives no traps and drains no spool.

services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    env_file:
      - .env.prod
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-ftth}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-change-me}
      POSTGRES_DB: ${POSTGRES_DB:-ftth_copilot}
    # Published on the loopback only. The worker runs with the host network
    # (it has to, to receive syslog with the real source IP), so it reaches
    # the database through the host instead of the compose network. Binding
    # it to 127.0.0.1 keeps the database reachable from the server and from
    # nowhere else.
    ports:
      - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER:-ftth} -d $${POSTGRES_DB:-ftth_copilot}"]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s
    networks:
      - ftth-network

  # ─────────────────────────────────────────────────────────────────────
  # Redis — durable job queue for the background worker.
  #
  # Self-hosted: no managed broker. Append-only persistence is on because
  # the queue holds the ingest backlog, and a job that was accepted but not
  # yet drained must survive a Redis restart. The volume is persistent
  # state: losing it loses queued work.
  # ─────────────────────────────────────────────────────────────────────
  redis:
    image: redis:8.10.2-alpine
    restart: unless-stopped
    environment:
      # The healthcheck authenticates with it.
      REDIS_PASSWORD: ${REDIS_PASSWORD}
    command:
      - redis-server
      - --appendonly
      - "yes"
      - --appendfsync
      - everysec
      # The queue holds the ingest backlog and the worker reaches Redis
      # through the host. A published port does NOT go through the host
      # firewall, so Redis must never be reachable without a password:
      # without it, anyone could inject jobs into the queue — fake events
      # that end up stored as DeviceEvent — or abuse the known
      # `CONFIG SET` trick to write files on the server.
      - --requirepass
      - ${REDIS_PASSWORD:?REDIS_PASSWORD must be set}
    env_file:
      - .env.prod
    ports:
      # Only the loopback: the worker runs on the host network and reaches
      # Redis there.
      - "127.0.0.1:${REDIS_PORT:-6379}:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      # It authenticates: a bare `redis-cli ping` gets NOAUTH and still
      # exits 0, so it would report a healthy Redis that nobody can use.
      test: ["CMD-SHELL", "redis-cli -a \"$$REDIS_PASSWORD\" --no-auth-warning ping | grep -q PONG"]
      interval: 15s
      timeout: 5s
      retries: 5
    networks:
      - ftth-network

  db-migrate:
    build:
      context: .
      dockerfile: Dockerfile
      target: dependencies
    restart: "no"
    command: ["pnpm", "--filter", "@ftth-copilot/db", "db:deploy"]
    env_file:
      - .env.prod
    depends_on:
      postgres:
        condition: service_healthy
    networks:
      - ftth-network

  app:
    build:
      context: .
      dockerfile: Dockerfile
      target: runner
    image: ftth-copilot:latest
    restart: unless-stopped
    env_file:
      - .env.prod
    environment:
      NODE_ENV: production
      PORT: 3001
      # The worker is the owner of the background work: the web serves HTTP
      # and the SSE stream, and nothing else. There is no `embedded` path
      # left to fall back to.
      BACKEND_MODE: worker
      # The durable queue. Redis is published on the loopback only and
      # requires a password; see the redis service below.
      # The web runs inside the compose network, so 127.0.0.1 would be the
      # web container itself. It reaches Redis by service name.
      REDIS_URL: "redis://:${REDIS_PASSWORD}@redis:6379"
      # Durable ingest spool. MUST be a persistent volume: events buffered
      # while Postgres is unreachable are lost if the container is recreated.
      # The web does not spool anything: the worker receives, writes and
      # drains. The variable stays declared so the volume keeps the two
      # subdirectories the layout expects.
      EVENT_SPOOL_DIR: /var/lib/ftth-copilot/spool/web
      # The kernel drops UDP datagrams silently once this buffer fills, so a
      # link flap needs headroom here.
      SYSLOG_RECV_BUFFER_BYTES: "${SYSLOG_RECV_BUFFER_BYTES:-4194304}"
    volumes:
      - spool_data:/var/lib/ftth-copilot/spool
    expose:
      - "3001"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully
    networks:
      - ftth-network

  # ─────────────────────────────────────────────────────────────────────
  # Worker — background job runner.
  #
  # Owns the polling, firmware audit, FEC collection, syslog/SNMP reception
  # and the event drainer. It is part of the stack, not an option: the web
  # only serves HTTP, so a worker that is not running means a system that
  # does not poll anything.
  #
  # It uses the host network on purpose: the syslog receiver is attributed
  # by the source IP of the datagram, and Docker's userland proxy for UDP
  # rewrites that address to the bridge gateway — every OLT would look like
  # the same source and the brute-force detectors would merge distinct
  # attacks into one. With the host network the kernel delivers the datagram
  # with the real source address.
  #
  # The spool volume is mounted here as well: the worker is the one that
  # receives syslog/SNMP and spools it, so the buffered events must survive
  # a restart of this container.
  # ─────────────────────────────────────────────────────────────────────
  worker:
    build:
      context: .
      dockerfile: services/worker/Dockerfile
    restart: unless-stopped
    network_mode: host
    env_file:
      - .env.prod
    environment:
      NODE_ENV: production
      REDIS_URL: "redis://:${REDIS_PASSWORD}@127.0.0.1:${REDIS_PORT:-6379}"
      DATABASE_URL: "postgresql://${POSTGRES_USER:-ftth}:${POSTGRES_PASSWORD:-change-me}@127.0.0.1:${POSTGRES_PORT:-5432}/${POSTGRES_DB:-ftth_copilot}"
      EVENT_SPOOL_DIR: /var/lib/ftth-copilot/spool/worker
      SYSLOG_RECV_BUFFER_BYTES: "${SYSLOG_RECV_BUFFER_BYTES:-4194304}"
      # The health server stays on the loopback: with the host network it
      # would otherwise listen on every public interface of the server.
      # Point it at a private interface (and set
      # VICTORIAMETRICS_WORKER_SCRAPE_TARGET) to let VictoriaMetrics scrape
      # it. See docs/worker.md.
      WORKER_HOST: ${WORKER_HOST:-127.0.0.1}
    volumes:
      - spool_data:/var/lib/ftth-copilot/spool
    depends_on:
      redis:
        condition: service_healthy
      db-migrate:
        condition: service_completed_successfully

  # ── Caddy reverse proxy ──────────────────────────────────────────────
  # Automatic HTTPS via Let's Encrypt.
  # Remove this service if you use your own reverse proxy (nginx, traefik, etc.)
  caddy:
    image: caddy:2-alpine
    container_name: ftth_caddy
    restart: unless-stopped
    ports:
      - "${CADDY_HTTP_PORT:-80}:80"
      - "${CADDY_HTTPS_PORT:-443}:443"
    volumes:
      - ./Caddyfile.prod:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    environment:
      CADDY_DOMAIN: ${CADDY_DOMAIN}
    depends_on:
      app:
        condition: service_started
    networks:
      - ftth-network

volumes:
  postgres_data:
  caddy_data:
  caddy_config:
  # Buffered syslog/SNMP events awaiting a write to Postgres. Losing this
  # volume loses telemetry, so it is treated as persistent state.
  spool_data:
  # Redis job queue — losing this loses queued background work.
  redis_data:

networks:
  ftth-network:
    driver: bridge