docker-compose.prod.yml

# Docker Compose for Pulsefeed Production (with HTTPS via Caddy)
#
# USAGE:
#   1. Set environment variables in .env.prod
#   2. docker-compose -f docker-compose.prod.yml up -d
#
# REQUIRED ENV VARS:
#   DOMAIN=yourdomain.com
#   SECRET_KEY=your-secure-secret-key
#   DB_ENCRYPTION_KEY=your-fernet-key
#
# Caddy automatically provisions Let's Encrypt certificates!

services:
  # Caddy Reverse Proxy (handles HTTPS automatically)
  caddy:
    image: caddy:2-alpine
    container_name: pulsefeed_caddy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"  # HTTP/3 support
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
    depends_on:
      - app
    environment:
      - DOMAIN=${DOMAIN:-localhost}

  # Flask Application
  app:
    build:
      context: .
      dockerfile: Dockerfile.prod
    container_name: pulsefeed_app
    restart: unless-stopped
    environment:
      - FLASK_ENV=production
      - FLASK_DEBUG=0
      - PORT=5000
      - SECRET_KEY=${SECRET_KEY}
      - DB_ENCRYPTION_KEY=${DB_ENCRYPTION_KEY}
      - DATABASE_URL=postgresql://pulsefeed:${DB_PASSWORD}@db:5432/pulsefeed
    depends_on:
      db:
        condition: service_healthy
    # No ports exposed - only accessible through Caddy
    expose:
      - "5000"

  # PostgreSQL Database
  db:
    image: postgres:15-alpine
    container_name: pulsefeed_db
    restart: unless-stopped
    environment:
      POSTGRES_USER: pulsefeed
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: pulsefeed
    volumes:
      - postgres_data:/var/lib/postgresql/data
    # No ports exposed externally in production
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U pulsefeed"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  postgres_data:
  caddy_data:
  caddy_config: