# =============================================================================
# Production overlay.
#
#   docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
#
# What it changes:
#   * Elasticsearch authentication is switched on and every client is given
#     credentials.
#   * Kibana is no longer published; reach it through an SSH tunnel or an
#     authenticating reverse proxy.
#   * Containers get CPU/memory limits and no longer seed the dataset on boot.
#   * The API is fronted by HTTPS (SECURE_SSL_REDIRECT + HSTS come from
#     config/settings/prod.py).
#
# TLS between the containers is intentionally out of scope here: in a real
# deployment the cluster sits behind a service mesh or an internal load
# balancer that terminates it.  See docs/SECURITY.md.
# =============================================================================

services:
  elasticsearch:
    environment:
      xpack.security.enabled: "true"
      ELASTIC_PASSWORD: ${ELASTIC_PASSWORD:?ELASTIC_PASSWORD is required in production}
    healthcheck:
      test:
        - "CMD-SHELL"
        - "curl -fsS -u elastic:${ELASTIC_PASSWORD} 'http://localhost:9200/_cluster/health?wait_for_status=yellow&timeout=5s' >/dev/null || exit 1"
    deploy:
      resources:
        limits: { memory: 2g }

  logstash:
    environment:
      # The Elasticsearch output reads its credentials from the URL.
      ELASTICSEARCH_HOSTS: http://elastic:${ELASTIC_PASSWORD}@elasticsearch:9200
    deploy:
      resources:
        limits: { memory: 1g }

  kibana:
    environment:
      ELASTICSEARCH_USERNAME: elastic
      ELASTICSEARCH_PASSWORD: ${ELASTIC_PASSWORD}
    # Remove the published port: Kibana is reached through a tunnel or proxy.
    ports: !reset []
    deploy:
      resources:
        limits: { memory: 1g }

  backend:
    environment:
      DJANGO_SETTINGS_MODULE: config.settings.prod
      DJANGO_DEBUG: "false"
      SECURE_SSL_REDIRECT: "true"
      ELASTICSEARCH_USERNAME: elastic
      ELASTICSEARCH_PASSWORD: ${ELASTIC_PASSWORD}
      # A production container must never mutate data on boot.
      SEED_DATASET: "false"
      SEED_USERS: "false"
    deploy:
      replicas: 2
      resources:
        limits: { cpus: "1.0", memory: 768m }

  frontend:
    deploy:
      resources:
        limits: { cpus: "0.5", memory: 128m }

  postgres:
    deploy:
      resources:
        limits: { memory: 1g }