docker-compose.prod.yml

services:
  migrate:
    image: ${API_IMAGE}
    command: migrate
    environment:
      PORT: 3000
      GIT_BRANCH: ${GIT_BRANCH:-unknown}
      DEPLOYMENT_ENVIRONMENT: ${DEPLOYMENT_ENVIRONMENT:-production}
    env_file:
      - prod.env
    networks:
      - backend
    deploy:
      placement:
        constraints:
          - node.role == manager
      restart_policy:
        # Use 'none' for one-shot migration tasks - don't restart after completion
        condition: none

  api:
    image: ${API_IMAGE}
    command: start
    # Enable EC2 instance role credentials for AWS SDK (S3, etc.)
    extra_hosts:
      - "169.254.169.254:169.254.169.254"
    environment:
      PORT: 3000
      GIT_COMMIT_SHA: ${GIT_COMMIT_SHA:-unknown}
      GIT_BRANCH: ${GIT_BRANCH:-unknown}
      DEPLOYMENT_ENVIRONMENT: ${DEPLOYMENT_ENVIRONMENT:-production}
    env_file:
      - prod.env
    ports:
      - published: 3001
        target: 3000
        protocol: tcp
        mode: ingress
    networks:
      - backend
      - execution
    deploy:
      replicas: 2
      resources:
        reservations:
          cpus: "0.25"
          memory: 100M
      # Rolling update configuration for zero-downtime deployments
      update_config:
        parallelism: 1          # Update one replica at a time
        delay: 10s              # Wait 10s between updates
        failure_action: rollback # Auto-rollback on failure
        monitor: 60s            # Monitor new containers for 60s
        max_failure_ratio: 0.3  # Allow 30% failure rate before rollback
        order: start-first      # Start new before stopping old (zero downtime)
      rollback_config:
        parallelism: 1
        delay: 0s
        failure_action: pause
        monitor: 60s
        order: stop-first
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 3
        window: 120s

  worker:
    image: ${API_IMAGE}
    command: worker
    # Enable EC2 instance role credentials for AWS SDK (S3, etc.)
    extra_hosts:
      - "169.254.169.254:169.254.169.254"
    environment:
      PORT: 3000
      CELERY_WORKER_QUEUES: default
      GIT_BRANCH: ${GIT_BRANCH:-unknown}
      DEPLOYMENT_ENVIRONMENT: ${DEPLOYMENT_ENVIRONMENT:-production}
    env_file:
      - prod.env
    networks:
      - backend
    deploy:
      resources:
        reservations:
          cpus: "0.25"
          memory: 100M
      # Rolling update configuration
      update_config:
        parallelism: 1          # Update one replica at a time
        delay: 10s              # Wait 10s between updates
        failure_action: rollback # Auto-rollback on failure
        monitor: 60s            # Monitor new containers for 60s
        max_failure_ratio: 0.3  # Allow 30% failure rate before rollback
      rollback_config:
        parallelism: 1
        delay: 0s
        failure_action: pause
        monitor: 60s
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 3
        window: 120s

  beat:
    image: ${API_IMAGE}
    command: beat
    # Enable EC2 instance role credentials for AWS SDK (S3, etc.)
    extra_hosts:
      - "169.254.169.254:169.254.169.254"
    environment:
      PORT: 3000
      GIT_BRANCH: ${GIT_BRANCH:-unknown}
      DEPLOYMENT_ENVIRONMENT: ${DEPLOYMENT_ENVIRONMENT:-production}
    env_file:
      - prod.env
    networks:
      - backend
    deploy:
      resources:
        reservations:
          cpus: "0.25"
          memory: 100M
      # Rolling update configuration
      update_config:
        parallelism: 1          # Update one replica at a time
        delay: 10s              # Wait 10s between updates
        failure_action: rollback # Auto-rollback on failure
        monitor: 60s            # Monitor new containers for 60s
        max_failure_ratio: 0.3  # Allow 30% failure rate before rollback
      rollback_config:
        parallelism: 1
        delay: 0s
        failure_action: pause
        monitor: 60s
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 3
        window: 120s

  docker:
    image: ${API_IMAGE}
    command: worker
    user: root
    # Enable EC2 instance role credentials for AWS SDK (S3, ECR, etc.)
    extra_hosts:
      - "169.254.169.254:169.254.169.254"
    environment:
      PORT: 3000
      # Only handle build tasks that require Docker socket access
      CELERY_WORKER_QUEUES: build
      GIT_BRANCH: ${GIT_BRANCH:-unknown}
      DEPLOYMENT_ENVIRONMENT: ${DEPLOYMENT_ENVIRONMENT:-production}
    env_file:
      - prod.env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - backend
    deploy:
      replicas: 2
      placement:
        constraints:
          - node.role == manager  # Run on manager nodes with Docker socket
      resources:
        reservations:
          cpus: "0.5"
          memory: 800M
        limits:
          cpus: "2.0"  # Allow bursting for Docker operations
          memory: 1.5G
      # Rolling update configuration for builder
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
        monitor: 60s
        max_failure_ratio: 0.5  # Allow 50% failure rate for redundancy
      rollback_config:
        parallelism: 1
        delay: 0s
        failure_action: pause
        monitor: 60s
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 3
        window: 120s

  redis:
    image: redis:7-alpine
    volumes:
      # Persistent Redis data storage - retains data across deployments
      - redis_prod_data:/data
    networks:
      - backend
    deploy:
      placement:
        constraints:
          - node.role == manager
      resources:
        reservations:
          cpus: "0.25"
          memory: 100M
      # Rolling update configuration for Redis
      update_config:
        parallelism: 1
        delay: 10s
        failure_action: rollback
        monitor: 60s
        max_failure_ratio: 0.3
      rollback_config:
        parallelism: 1
        delay: 0s
        failure_action: pause
        monitor: 60s
    # Append-only file persistence for Redis data durability
    command: redis-server --appendonly yes --appendfsync everysec

volumes:
  # Persistent Redis data volume - maintains session data, cache, and Celery task state across deployments
  redis_prod_data:
    driver: local

networks:
  backend:
    driver: overlay
    attachable: true
    ipam:
      driver: default
      config:
        - subnet: ${DOCKER_SUBNET:-10.10.0.0/16}
  execution:
    driver: overlay
    attachable: true
    ipam:
      driver: default
      config:
        - subnet: ${EXECUTION_SUBNET:-10.11.0.0/24}