# SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
# The mongodb profile's compose.yaml: the same three processes from one image as the default
# (postgres) profile, with this profile's two links in place of the three Postgres roles
# (spec §5.1).
#
# MongoDB has no row-level security, so there is no owner/runtime/reader split to enforce it
# with: every process holds the one MONGODB_URL the platform injects for a linked MongoDB, and
# the tenant wall is the repository predicate, proven by the kit's contract suite
# (@conusai-kit/data-mongo runs it against MongoDB 8 as a single-node replica set). Jobs are
# BullMQ on the linked Valkey (REDIS_URL).
#
# The linked MongoDB service must be created with `replica_set` set (AT-D15): a standalone server
# has no multi-document transactions, and the adapter refuses to boot against one. When
# `replica_set` is set the platform starts mongod with --replSet and rs.initiate(), and the
# injected MONGODB_URL carries directConnection=true.
#
# Ordering is the default profile's mechanism unchanged (decision AT-D14): migrate carries
# `restart: "no"`, and web and worker wait for it with `condition: service_completed_successfully`.
services:
  web:
    build:
      context: .
      dockerfile: Dockerfile
      target: runtime
    working_dir: /app/apps/web
    command: ["node", "node_modules/next/dist/bin/next", "start"]
    environment:
      NODE_ENV: production
      PORT: "3000"
      CONUSAI_API_URL: ${CONUSAI_API_URL}
      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
      CONUSAI_PUBLIC_URL: ${CONUSAI_PUBLIC_URL}
      CONUSAI_ORG_ID: ${CONUSAI_ORG_ID}
      CONUSAI_ORG_SLUG: ${CONUSAI_ORG_SLUG:-}
      CONUSAI_RELEASE: ${CONUSAI_RELEASE}
      CONUSAI_ENVIRONMENT: ${CONUSAI_ENVIRONMENT:-}
      CONUSAI_DSN: ${CONUSAI_DSN:-}
      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
      OTEL_EXPORTER_OTLP_PROTOCOL: ${OTEL_EXPORTER_OTLP_PROTOCOL:-}
      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
      OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-}
      OTEL_SERVICE_VERSION: ${OTEL_SERVICE_VERSION:-}
      AI_MODEL: ${AI_MODEL:-}
      LOG_LEVEL: ${LOG_LEVEL:-}
      MONGODB_URL: ${MONGODB_URL}
      REDIS_URL: ${REDIS_URL}
      AUTH_SESSION_SECRET: ${AUTH_SESSION_SECRET}
      OIDC_ISSUER: ${OIDC_ISSUER:-}
      OIDC_WEB_CLIENT_ID: ${OIDC_WEB_CLIENT_ID:-}
      OIDC_WEB_CLIENT_SECRET: ${OIDC_WEB_CLIENT_SECRET:-}
      OIDC_RESOURCE: ${OIDC_RESOURCE:-}
      OIDC_INTROSPECTION_CLIENT_ID: ${OIDC_INTROSPECTION_CLIENT_ID:-}
      OIDC_INTROSPECTION_CLIENT_SECRET: ${OIDC_INTROSPECTION_CLIENT_SECRET:-}
      OIDC_RESOURCE_STATUS_URL: ${OIDC_RESOURCE_STATUS_URL:-}
      OIDC_SCOPES: ${OIDC_SCOPES:-}
      AUTH_PROVIDER_GENERATION: ${AUTH_PROVIDER_GENERATION:-}
      AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-}
      AUTH_SESSION_IDLE_SECONDS: ${AUTH_SESSION_IDLE_SECONDS:-}
      AUTH_SESSION_ABSOLUTE_SECONDS: ${AUTH_SESSION_ABSOLUTE_SECONDS:-}
      OIDC_AUDIENCE: ${OIDC_AUDIENCE:-}
    expose: ["3000"]
    depends_on:
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/ready').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 20s
    init: true
    stop_grace_period: 20s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 768M

  worker:
    build:
      context: .
      dockerfile: Dockerfile
      target: runtime
    working_dir: /app
    command: ["node", "apps/worker/dist/main.js"]
    environment:
      NODE_ENV: production
      CONUSAI_API_URL: ${CONUSAI_API_URL}
      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
      CONUSAI_ORG_ID: ${CONUSAI_ORG_ID}
      CONUSAI_ORG_SLUG: ${CONUSAI_ORG_SLUG:-}
      CONUSAI_RELEASE: ${CONUSAI_RELEASE}
      CONUSAI_ENVIRONMENT: ${CONUSAI_ENVIRONMENT:-}
      CONUSAI_DSN: ${CONUSAI_DSN:-}
      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
      OTEL_EXPORTER_OTLP_PROTOCOL: ${OTEL_EXPORTER_OTLP_PROTOCOL:-}
      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
      OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-}
      OTEL_SERVICE_VERSION: ${OTEL_SERVICE_VERSION:-}
      AI_MODEL: ${AI_MODEL:-}
      LOG_LEVEL: ${LOG_LEVEL:-}
      MONGODB_URL: ${MONGODB_URL}
      REDIS_URL: ${REDIS_URL}
      WORKER_HEARTBEAT_FILE: /tmp/worker-heartbeat
    depends_on:
      migrate:
        condition: service_completed_successfully
    healthcheck:
      test: ["CMD", "node", "apps/worker/dist/healthcheck.js"]
      interval: 15s
      timeout: 5s
      retries: 3
      start_period: 20s
    init: true
    stop_grace_period: 30s
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M

  migrate:
    build:
      context: .
      dockerfile: Dockerfile
      target: runtime
    working_dir: /app
    command: ["node", "apps/worker/dist/migrate.js"]
    environment:
      NODE_ENV: production
      CONUSAI_API_URL: ${CONUSAI_API_URL}
      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
      # One login, not three: there is no RLS to bind, so the owner/runtime/reader split of the
      # postgres profile has no counterpart here (decision AT-D20 is Postgres-only, DS21).
      MONGODB_URL: ${MONGODB_URL}
    restart: "no"
    init: true
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M