name: musify-prod

# Production overlay: adds the nginx edge and the host-mounted secrets.
# Nothing but nginx publishes a port; every other service is reachable only on
# the internal `musify-prod_default` network.
#
#   docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml up -d
#   docker compose --env-file deploy/.env.prod -f deploy/compose.yml -f deploy/compose.prod.yml --profile apps up -d --build
#
# The first command starts the infrastructure, the nginx edge and the
# one-shot bootstrap jobs (stream keys, migrations, Zitadel project/apps); the
# second builds and starts the applications, picking up the OIDC client ids
# the first command just wrote into deploy/.env.prod. See deploy/README.md.

services:
  worker:
    # yt-dlp reads the YouTube cookie jar from here (see YTDLP_ADDITIONAL_ARGUMENTS).
    volumes:
      - ./secrets:/secrets:ro

  # zitadel-init (compose.yml) edits whichever env file is mounted here.
  zitadel-init:
    volumes:
      - ./.env.prod:/workspace/.env

  # Every vhost proxies through `set $upstream ...; proxy_pass $upstream;`
  # with the embedded Docker DNS resolver (see nginx/templates), so nginx
  # does not need api/gateway/web-player to exist at its own startup — only
  # at request time. That is what lets it start in the FIRST command
  # (profile-gated services aren't part of that invocation yet) and still be
  # reachable at the auth domain for zitadel-init to provision through.
  nginx:
    image: nginx:1.27-alpine
    container_name: musify-nginx
    depends_on:
      zitadel:
        condition: service_started
    environment:
      # The entrypoint renders /etc/nginx/templates/*.template with envsubst.
      # The filter keeps it from eating nginx's own $host / $remote_addr.
      MUSIFY_ROOT_DOMAIN: ${ROOT_DOMAIN}
      MUSIFY_MAX_UPLOAD_SIZE: ${MAX_UPLOAD_SIZE:-1024m}
      MUSIFY_THUMBNAIL_CACHE_SIZE: ${THUMBNAIL_CACHE_SIZE:-2g}
      NGINX_ENVSUBST_FILTER: ^MUSIFY_
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/templates:/etc/nginx/templates:ro
      - ./nginx/snippets:/etc/nginx/snippets:ro
      - ./nginx/certs:/etc/nginx/certs:ro
      - nginx_cache:/var/cache/nginx
    restart: unless-stopped

volumes:
  nginx_cache: