# BaraDB — Production Docker Compose
# Usage: docker compose -f docker-compose.prod.yml up -d
#
# Препоръчителни стъпки преди production deployment:
#   1. Създайте TLS сертификати в ./certs/
#   2. Задайте силен BARADB_JWT_SECRET
#   3. Настройте firewall правила за портовете
#   4. Конфигурирайте регулярни backups

services:
  baradb:
    build:
      context: .
      dockerfile: Dockerfile
    image: baradb:latest
    container_name: baradb
    hostname: baradb
    restart: always

    ports:
      - "9472:9472"   # Binary protocol
      - "9912:9912"   # HTTP/REST API
      - "9913:9913"   # WebSocket

    volumes:
      - baradb_data:/data
      # TLS сертификати (read-only)
      - ./certs:/certs:ro
      # Лог файлове на хоста
      - ./logs:/var/log/baradb

    environment:
      # Network
      - BARADB_ADDRESS=0.0.0.0
      - BARADB_PORT=9472

      # Storage
      - BARADB_DATA_DIR=/data
      - BARADB_MEMTABLE_SIZE_MB=256
      - BARADB_CACHE_SIZE_MB=512

      # TLS (разкоментирайте когато имате сертификати)
      # - BARADB_TLS_ENABLED=true
      # - BARADB_CERT_FILE=/certs/server.crt
      # - BARADB_KEY_FILE=/certs/server.key

      # Security (ЗАДЪЛЖИТЕЛНО сменете в production!)
      # - BARADB_AUTH_ENABLED=true
      # - BARADB_JWT_SECRET=change-me-to-random-32-char-string
      # - BARADB_RATE_LIMIT_GLOBAL=10000
      # - BARADB_RATE_LIMIT_PER_CLIENT=1000

      # Logging
      - BARADB_LOG_LEVEL=warn
      - BARADB_LOG_FILE=/var/log/baradb/baradb.log
      - BARADB_LOG_FORMAT=json

      # Performance
      - BARADB_COMPACTION_INTERVAL_MS=30000
      - BARADB_WAL_SYNC_INTERVAL_MS=10

    healthcheck:
      test: ["CMD", "sh", "-c", "wget -qO- http://localhost:9912/health >/dev/null 2>&1"]
      interval: 15s
      timeout: 5s
      retries: 5
      start_period: 30s

    # Production resource limits
    deploy:
      resources:
        limits:
          cpus: '4.0'
          memory: 8G
        reservations:
          cpus: '1.0'
          memory: 1G

    # Security hardening
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:noexec,nosuid,size=100m

    networks:
      - baradb_net

    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"
        labels: "service_name"

  # Опционален: Backup cron job
  backup:
    image: baradb:latest
    container_name: baradb-backup
    restart: unless-stopped
    command: >
      sh -c '
        while true; do
          sleep 86400;
          /app/backup backup --data-dir=/data --output=/backups/baradb_$$(date +%Y%m%d_%H%M%S).tar.gz --level=6;
          /app/backup cleanup --keep=7;
        done
      '
    volumes:
      - baradb_data:/data:ro
      - ./backups:/backups
    networks:
      - baradb_net
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M

volumes:
  baradb_data:
    driver: local

networks:
  baradb_net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16