compose.prod.yaml

# Define common dependencies anchor before it's used
x-cloud-depends-on: &cloud-depends-on
  postgres:
    condition: service_healthy
  s3:
    condition: service_healthy
  redis:
    condition: service_healthy
  redis-cloud:
    condition: service_healthy
  datastore:
    condition: service_healthy

# Define environment variables anchor before it's used
x-cloud-environment: &cloud-worker-env
  DATABASE_URL: ${DATABASE_URL:-postgresql://postgres:postgres@postgres:5432/postgres}
  SALT: ${SALT:-mysalt}
  ENCRYPTION_KEY: ${ENCRYPTION_KEY:-0000000000000000000000000000000000000000000000000000000000000000} # generate via `openssl rand -hex 32`
  TELEMETRY_ENABLED: ${TELEMETRY_ENABLED:-true}
  HANZO_ENABLE_EXPERIMENTAL_FEATURES: ${HANZO_ENABLE_EXPERIMENTAL_FEATURES:-true}
  DATASTORE_MIGRATION_URL: "datastore://datastore:9000"
  DATASTORE_URL: "http://datastore:8123"
  DATASTORE_USER: "hanzo"
  DATASTORE_PASSWORD: "hanzo"
  DATASTORE_CLUSTER_ENABLED: "false"
  S3_EVENT_UPLOAD_BUCKET: ${S3_EVENT_UPLOAD_BUCKET:-hanzo}
  S3_EVENT_UPLOAD_REGION: ${S3_EVENT_UPLOAD_REGION:-auto}
  S3_EVENT_UPLOAD_ACCESS_KEY_ID: ${S3_EVENT_UPLOAD_ACCESS_KEY_ID:-minio}
  S3_EVENT_UPLOAD_SECRET_ACCESS_KEY: ${S3_EVENT_UPLOAD_SECRET_ACCESS_KEY:-miniosecret}
  S3_EVENT_UPLOAD_ENDPOINT: ${S3_EVENT_UPLOAD_ENDPOINT:-http://s3:9000}
  S3_EVENT_UPLOAD_FORCE_PATH_STYLE: ${S3_EVENT_UPLOAD_FORCE_PATH_STYLE:-true}
  S3_EVENT_UPLOAD_PREFIX: ${S3_EVENT_UPLOAD_PREFIX:-events/}
  S3_MEDIA_UPLOAD_BUCKET: ${S3_MEDIA_UPLOAD_BUCKET:-hanzo}
  S3_MEDIA_UPLOAD_REGION: ${S3_MEDIA_UPLOAD_REGION:-auto}
  S3_MEDIA_UPLOAD_ACCESS_KEY_ID: ${S3_MEDIA_UPLOAD_ACCESS_KEY_ID:-minio}
  S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY: ${S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY:-miniosecret}
  S3_MEDIA_UPLOAD_ENDPOINT: ${S3_MEDIA_UPLOAD_ENDPOINT:-http://s3:9000}
  S3_MEDIA_UPLOAD_FORCE_PATH_STYLE: ${S3_MEDIA_UPLOAD_FORCE_PATH_STYLE:-true}
  S3_MEDIA_UPLOAD_PREFIX: ${S3_MEDIA_UPLOAD_PREFIX:-media/}
  HANZO_INGESTION_QUEUE_DELAY_MS: ${HANZO_INGESTION_QUEUE_DELAY_MS:-}
  HANZO_INGESTION_DATASTORE_WRITE_INTERVAL_MS: ${HANZO_INGESTION_DATASTORE_WRITE_INTERVAL_MS:-}
  REDIS_HOST: ${REDIS_HOST:-redis}
  REDIS_PORT: ${REDIS_PORT:-6379}
  REDIS_AUTH: ${REDIS_AUTH:-myredissecret}
  REDIS_TLS_ENABLED: ${REDIS_TLS_ENABLED:-false}
  REDIS_TLS_CA: ${REDIS_TLS_CA:-/certs/ca.crt}
  REDIS_TLS_CERT: ${REDIS_TLS_CERT:-/certs/redis.crt}
  REDIS_TLS_KEY: ${REDIS_TLS_KEY:-/certs/redis.key}

services:
  console:
    image: hanzoai/console:latest
    build:
      context: .
      dockerfile: web/Dockerfile
      args:
        NEXT_PUBLIC_HANZO_CLOUD_REGION: ${NEXT_PUBLIC_HANZO_CLOUD_REGION:-US}
        STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-sk-live-xxx}
        NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:-pk-live-xxx}
        STRIPE_WEBHOOK_SIGNING_SECRET: ${STRIPE_WEBHOOK_SIGNING_SECRET:-your-secret}
    restart: always
    depends_on: *cloud-depends-on
    #ports:
    #  - "3000:3000"
    environment:
      <<: *cloud-worker-env
      NEXT_PUBLIC_HANZO_CLOUD_REGION: ${NEXT_PUBLIC_HANZO_CLOUD_REGION:-US}
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-sk-live-xxx}
      NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:-pk-live-xxx}
      STRIPE_WEBHOOK_SIGNING_SECRET: ${STRIPE_WEBHOOK_SIGNING_SECRET:-your-secret}
      NEXTAUTH_URL: ${NEXTAUTH_URL:-https://console.hanzo.ai}
      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:-mysecret}
      INIT_ORG_ID: ${INIT_ORG_ID:-}
      INIT_ORG_NAME: ${INIT_ORG_NAME:-}
      INIT_ORG_IDS: ${INIT_ORG_IDS:-}
      INIT_ORG_NAMES: ${INIT_ORG_NAMES:-}
      INIT_PROJECT_ID: ${INIT_PROJECT_ID:-}
      INIT_PROJECT_ORG_ID: ${INIT_PROJECT_ORG_ID:-}
      INIT_PROJECT_NAME: ${INIT_PROJECT_NAME:-}
      INIT_PROJECT_PUBLIC_KEY: ${INIT_PROJECT_PUBLIC_KEY:-}
      INIT_PROJECT_SECRET_KEY: ${INIT_PROJECT_SECRET_KEY:-}
      INIT_USER_EMAIL: ${INIT_USER_EMAIL:-}
      INIT_USER_NAME: ${INIT_USER_NAME:-}
      INIT_USER_PASSWORD: ${INIT_USER_PASSWORD:-}
      IAM_APP_NAME: ${IAM_APP_NAME:-}
      IAM_CLIENT_ID: ${IAM_CLIENT_ID:-}
      IAM_CLIENT_SECRET: ${IAM_CLIENT_SECRET:-}
      IAM_ORG_NAME: ${IAM_ORG_NAME:-}

      IAM_SERVER_URL: ${IAM_SERVER_URL:-}
      IAM_ALLOW_ACCOUNT_LINKING: ${IAM_ALLOW_ACCOUNT_LINKING:-}
      AUTH_DISABLE_USERNAME_PASSWORD: ${AUTH_DISABLE_USERNAME_PASSWORD:-true}
      S3_FREE_PLAN_EXPIRE: ${S3_FREE_PLAN_EXPIRE:-90}
      SMTP_CONNECTION_URL: ${SMTP_CONNECTION_URL:-smtp://dev@hanzo.ai:md-iOMNRc1olJUrZMSvBaGAbA@smtp.mandrillapp.com:587}
    networks:
      - hanzo-network
      - cloud-hanzo-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.well-known.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.middlewares.console-csp.headers.customResponseHeaders.Content-Security-Policy=connect-src 'self' https://console.hanzo.ai http://console.hanzo.ai;"
      - "traefik.http.routers.console-http.rule=Host(`console.hanzo.ai`)"
      - "traefik.http.routers.console-http.entrypoints=web"
      - "traefik.http.routers.console-http.middlewares=well-known,console-csp,redirect-to-https"
      - "traefik.http.routers.console-https.rule=Host(`console.hanzo.ai`)"
      - "traefik.http.routers.console-https.entrypoints=websecure"
      - "traefik.http.routers.console-https.middlewares=well-known,console-csp"
      - "traefik.http.routers.console-https.tls.certresolver=letsencrypt"
      - "traefik.http.services.console-service.loadbalancer.server.port=3000"

  console-worker:
    image: hanzoai/console-worker:latest
    restart: always
    depends_on: *cloud-depends-on
    #ports:
    #  - "3030:3030"
    environment: *cloud-worker-env
    networks:
      - hanzo-network
      - cloud-hanzo-network

  datastore:
    image: ghcr.io/hanzoai/datastore:latest
    restart: always
    user: "101:101"
    environment:
      DATASTORE_DB: default
      DATASTORE_USER: hanzo
      DATASTORE_PASSWORD: hanzo
      DATASTORE_DEFAULT_ACCESS_MANAGEMENT: 1
    volumes:
      - cloud-datastore-data:/var/lib/datastore
      - cloud-datastore-logs:/var/log/datastore
    #ports:
    #  - "8123:8123"
    #  - "9000:9000"
    healthcheck:
      test: wget --no-verbose --tries=1 --spider http://localhost:8123/ping || exit 1
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 1s
    networks:
      - hanzo-network
      - cloud-hanzo-network

  s3:
    image: ghcr.io/hanzoai/s3:latest
    restart: always
    entrypoint: sh
    # create the 'cloud' bucket before starting the service
    command: -c 'mkdir -p /data/cloud && minio server --address ":9000" --console-address ":9001" /data'
    environment:
      MINIO_ROOT_USER: minio
      MINIO_ROOT_PASSWORD: miniosecret
    #ports:
    #  - "9090:9000"
    #  - "9091:9001"
    volumes:
      - cloud-s3-data:/data
    healthcheck:
      test: ["CMD-SHELL", "curl -sf http://localhost:9000/minio/health/live"]
      interval: 1s
      timeout: 5s
      retries: 5
      start_period: 1s
    networks:
      - cloud-hanzo-network

  redis:
    image: redis:alpine
    restart: always
    command: >
      --requirepass ${REDIS_AUTH:-myredissecret}
    #ports:
    #  - 6379:6379
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 3s
      timeout: 10s
      retries: 10
    networks:
      - hanzo-network
      - cloud-hanzo-network

  postgres:
    image: postgres:${POSTGRES_VERSION:-latest}
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 3s
      timeout: 3s
      retries: 10
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: postgres
    #ports:
    #  - 5432:5432
    volumes:
      - cloud-postgres-data:/var/lib/postgresql/data
    networks:
      - hanzo-network
      - cloud-hanzo-network

  redis-cloud:
    image: redis:alpine
    restart: always
    command: >
      --requirepass ${REDIS_AUTH:-myredissecret}
    environment:
      REDIS_PASSWORD: ${REDIS_AUTH:-myredissecret}
    healthcheck:
      test: ["CMD", "redis-cli", "-a", "${REDIS_AUTH:-myredissecret}", "ping"]
      interval: 3s
      timeout: 10s
      retries: 10
    networks:
      - hanzo-network
      - cloud-hanzo-network

    volumes:
      - cloud-redis-cloud-data:/data

networks:
  cloud-hanzo-network:
    driver: bridge
  hanzo-network:
    external: true

volumes:
  cloud-postgres-data:
    name: cloud-postgres-data-prod
    driver: local
  cloud-datastore-data:
    driver: local
  cloud-datastore-logs:
    driver: local
  cloud-s3-data:
    driver: local
  cloud-redis-cloud-data:
    driver: local