# docker-compose.prod.yml — Production with Traefik
# Usage: docker compose -f docker-compose.prod.yml up -d
#
# Podman alternative:
#   podman-compose -f docker-compose.prod.yml up -d
# Or use quadlet files in ./quadlet/ for systemd integration.

services:
  # ── Traefik Reverse Proxy ───────────────────────────────────
  traefik:
    image: traefik:v3.2
    container_name: traefik
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - traefik-certs:/certs
    labels:
      - "traefik.enable=true"
    restart: unless-stopped

  # ── AI Proxy ────────────────────────────────────────────────
  proxy:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: proxym
    env_file: .env
    environment:
      - REDIS_URL=redis://redis:6379/0
      - AI_PROXY_LOG_LEVEL=warning
    depends_on:
      redis:
        condition: service_healthy
    volumes:
      - ./project:/app/project:ro
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.proxy.rule=Host(`proxym.local`)"
      - "traefik.http.routers.proxy.tls=true"
      - "traefik.http.services.proxy.loadbalancer.server.port=4000"
      - "traefik.http.routers.proxy.middlewares=ratelimit@docker"
      - "traefik.http.middlewares.ratelimit.ratelimit.average=100"
      - "traefik.http.middlewares.ratelimit.ratelimit.burst=50"
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "2.0"

  # ── Redis ───────────────────────────────────────────────────
  redis:
    image: redis/redis-stack:latest
    container_name: proxym-redis
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 512M

volumes:
  redis-data:
  traefik-certs:
