# SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
# The Convex provider provisions a backend and injects its URL/admin key; it does not deploy this
# app's functions. The one-shot `convex-deploy` service does that from the app image, and web and
# backup wait for it to succeed. The app's server-side BFF is the only client of the admin key.
#
# The tenant wall on this profile is the repository predicate plus the custom functions the
# generated wrappers are built with (spec §5.3), proven by the kit's contract and isolation
# suites under convex-test (@conusai-kit/data-convex).
services:
  web:
    build:
      context: .
      dockerfile: Dockerfile
      target: runtime
    working_dir: /app/apps/web
    command: ["node", "node_modules/next/dist/bin/next", "start"]
    environment:
      NODE_ENV: production
      PORT: "3000"
      CONUSAI_API_URL: ${CONUSAI_API_URL}
      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
      CONUSAI_PUBLIC_URL: ${CONUSAI_PUBLIC_URL}
      CONUSAI_ORG_ID: ${CONUSAI_ORG_ID}
      CONUSAI_ORG_SLUG: ${CONUSAI_ORG_SLUG}
      CONUSAI_RELEASE: ${CONUSAI_RELEASE}
      CONUSAI_ENVIRONMENT: ${CONUSAI_ENVIRONMENT:-}
      CONUSAI_DSN: ${CONUSAI_DSN:-}
      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
      OTEL_EXPORTER_OTLP_PROTOCOL: ${OTEL_EXPORTER_OTLP_PROTOCOL:-}
      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
      OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-}
      OTEL_SERVICE_VERSION: ${OTEL_SERVICE_VERSION:-}
      AI_MODEL: ${AI_MODEL:-}
      LOG_LEVEL: ${LOG_LEVEL:-}
      CONVEX_SELF_HOSTED_URL: ${CONVEX_SELF_HOSTED_URL}
      CONVEX_SELF_HOSTED_ADMIN_KEY: ${CONVEX_SELF_HOSTED_ADMIN_KEY}
      AUTH_SESSION_SECRET: ${AUTH_SESSION_SECRET}
      OIDC_ISSUER: ${OIDC_ISSUER:-}
      OIDC_WEB_CLIENT_ID: ${OIDC_WEB_CLIENT_ID:-}
      OIDC_WEB_CLIENT_SECRET: ${OIDC_WEB_CLIENT_SECRET:-}
      OIDC_RESOURCE: ${OIDC_RESOURCE:-}
      OIDC_INTROSPECTION_CLIENT_ID: ${OIDC_INTROSPECTION_CLIENT_ID:-}
      OIDC_INTROSPECTION_CLIENT_SECRET: ${OIDC_INTROSPECTION_CLIENT_SECRET:-}
      OIDC_RESOURCE_STATUS_URL: ${OIDC_RESOURCE_STATUS_URL:-}
      OIDC_SCOPES: ${OIDC_SCOPES:-}
      AUTH_PROVIDER_GENERATION: ${AUTH_PROVIDER_GENERATION:-}
      AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-}
      AUTH_SESSION_IDLE_SECONDS: ${AUTH_SESSION_IDLE_SECONDS:-}
      AUTH_SESSION_ABSOLUTE_SECONDS: ${AUTH_SESSION_ABSOLUTE_SECONDS:-}
      OIDC_AUDIENCE: ${OIDC_AUDIENCE:-}
      AUTH_PROVIDER: ${AUTH_PROVIDER:-}
      AUTH_IDENTITY_NAMESPACE: ${AUTH_IDENTITY_NAMESPACE:-}
      # kit:convex-better-auth:begin -- Better Auth's own Convex deployment, beside the app's
      BETTER_AUTH_CONVEX_URL: ${BETTER_AUTH_CONVEX_URL:-}
      BETTER_AUTH_CONVEX_SITE_URL: ${BETTER_AUTH_CONVEX_SITE_URL:-}
      BETTER_AUTH_CONVEX_ADMIN_KEY: ${BETTER_AUTH_CONVEX_ADMIN_KEY:-}
      BETTER_AUTH_RELAY_INTERVAL_MS: ${BETTER_AUTH_RELAY_INTERVAL_MS:-}
      # kit:convex-better-auth:end
    expose: ["3000"]
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/ready').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 20s
    init: true
    stop_grace_period: 20s
    depends_on:
      convex-deploy:
        condition: service_completed_successfully
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 768M

  # The provider only provisions Convex. Push this app's schema and functions before web and
  # backup start, and make failure block traffic instead of reporting a healthy empty backend.
  convex-deploy:
    build:
      context: .
      dockerfile: Dockerfile
      target: runtime
    working_dir: /app
    command: ["node", "profiles/convex/deploy.mjs"]
    environment:
      NODE_ENV: production
      CONUSAI_API_URL: ${CONUSAI_API_URL}
      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
      CONUSAI_ORG_SLUG: ${CONUSAI_ORG_SLUG}
      AI_MODEL: ${AI_MODEL:-}
      DOCUMENTS_EXCLUDED_PAGE_CLASSES: ${DOCUMENTS_EXCLUDED_PAGE_CLASSES:-}
      CONVEX_SELF_HOSTED_URL: ${CONVEX_SELF_HOSTED_URL}
      CONVEX_SELF_HOSTED_ADMIN_KEY: ${CONVEX_SELF_HOSTED_ADMIN_KEY}
      # kit:convex-better-auth:begin -- this job also deploys the Better Auth functions, and alone holds the secret;
      # it installs the deployment's URL, admin key and namespace in the app's backend for the account actions
      AUTH_PROVIDER: ${AUTH_PROVIDER:-}
      AUTH_IDENTITY_NAMESPACE: ${AUTH_IDENTITY_NAMESPACE:-}
      CONUSAI_PUBLIC_URL: ${CONUSAI_PUBLIC_URL}
      BETTER_AUTH_CONVEX_URL: ${BETTER_AUTH_CONVEX_URL:-}
      BETTER_AUTH_CONVEX_ADMIN_KEY: ${BETTER_AUTH_CONVEX_ADMIN_KEY:-}
      BETTER_AUTH_SECRET: ${BETTER_AUTH_SECRET:-}
      # kit:convex-better-auth:end
    restart: "no"
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 768M

  # convex export is a CLI operation and cannot run from a Convex query/mutation/cron. This small
  # sidecar schedules it outside the backend and stores archives in the platform Blob service.
  backup:
    build:
      context: .
      dockerfile: Dockerfile
      target: runtime
    working_dir: /app
    command: ["node", "profiles/convex/backup/runner.mjs"]
    environment:
      NODE_ENV: production
      CONUSAI_API_URL: ${CONUSAI_API_URL}
      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
      CONVEX_SELF_HOSTED_URL: ${CONVEX_SELF_HOSTED_URL}
      CONVEX_SELF_HOSTED_ADMIN_KEY: ${CONVEX_SELF_HOSTED_ADMIN_KEY}
      CONVEX_BACKUP_INTERVAL_HOURS: ${CONVEX_BACKUP_INTERVAL_HOURS:-24}
      CONVEX_BACKUP_RETENTION: ${CONVEX_BACKUP_RETENTION:-30}
    init: true
    stop_grace_period: 30s
    restart: unless-stopped
    depends_on:
      convex-deploy:
        condition: service_completed_successfully
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M