# Production-style override: put the gateway (frontend + API) behind Traefik
# with automatic Let's Encrypt TLS. Use together with the base file:
#
#   docker compose -f docker-compose.yml -f docker-compose.traefik.yml up -d --build
#
# Only Traefik publishes host ports (80/443). Everything else is reachable
# only on the compose network.

services:
  traefik:
    image: traefik:v3.6
    restart: unless-stopped
    command:
      - --providers.docker=true
      - --providers.docker.exposedByDefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.le.acme.httpchallenge=true
      - --certificatesresolvers.le.acme.httpchallenge.entrypoint=web
      - --certificatesresolvers.le.acme.storage=/letsencrypt/acme.json
      - --log.level=INFO
      - --accesslog=true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/letsencrypt

  gateway:
    ports: !reset []
    labels:
      - traefik.enable=true
      - traefik.http.routers.ledgerline.rule=Host(`ledgerline.vione.cloud`)
      - traefik.http.routers.ledgerline.entrypoints=websecure
      - traefik.http.routers.ledgerline.tls.certresolver=le
      - traefik.http.services.ledgerline.loadbalancer.server.port=8000

  postgres:
    ports: !reset []

  redis:
    ports: !reset []

  ledger:
    ports: !reset []

  fraud:
    ports: !reset []

  sanctions:
    ports: !reset []

  insights:
    ports: !reset []

  notifier:
    ports: !reset []

  # Ships every container's stdout/stderr to the platform's Loki on falken
  # (k8s/), labelled `container`. Credentials come from .env.observability,
  # generated by k8s/create-secrets.sh and copied to the server once.
  # Publishes no ports; memory-capped because czy has 1 GB of RAM. Steady
  # state is ~70 MiB, but the initial backfill of every container's log
  # history peaked at ~150 MiB in testing, hence the headroom.
  alloy-agent:
    image: grafana/alloy:v1.10.2
    restart: unless-stopped
    command:
      - run
      - --storage.path=/var/lib/alloy/data
      - /etc/alloy/config.alloy
    env_file: .env.observability
    mem_limit: 256m
    volumes:
      - ./observability/alloy-agent/config.alloy:/etc/alloy/config.alloy:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - alloy-agent-data:/var/lib/alloy/data

volumes:
  letsencrypt:
  alloy-agent-data: