# ─────────────────────────────────────────────────────────────────────────────
# AiMANAC — example docker-compose.yml
# A complete self-hosted stack: aimanac-server + postgres (pgvector) + redis,
# fronted by nginx for TLS + the /ihp-ws WebSocket route.
#
# Replace every {{MUSTACHE}} value with the real value from the JSON spec on
# https://aimanac.llmtech.net/setup/llm/  — do NOT trust LLM-recalled values
# for the image tag or env-var list.
#
# Required secrets (generate yours; do NOT copy these placeholders verbatim):
#   POSTGRES_PASSWORD     openssl rand -hex 16
#   APP_SECRET            openssl rand -hex 32   (used as JWT_SECRET)
#   APP_REFRESH_SECRET    openssl rand -hex 64   (used as JWT_REFRESH_SECRET)
#   APP_ENCRYPTION_KEY    openssl rand -hex 32   (used as ENCRYPTION_KEY)
#   PUBLIC_HOST           your public DNS name (e.g. my-aimanac.example.com)
# ─────────────────────────────────────────────────────────────────────────────

version: "3.9"

services:
  aimanac-server:
    image: "{{IMAGE_REGISTRY}}/{{IMAGE_NAME}}:{{IMAGE_TAG}}"
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    environment:
      DATABASE_URL:        "postgres://aimanac:${POSTGRES_PASSWORD}@postgres:5432/aimanac"
      REDIS_URL:           "redis://redis:6379/0"
      BACKEND_PUBLIC_URL:  "https://${PUBLIC_HOST}"
      JWT_SECRET:          "${APP_SECRET}"
      JWT_REFRESH_SECRET:  "${APP_REFRESH_SECRET}"
      ENCRYPTION_KEY:      "${APP_ENCRYPTION_KEY}"
      TRUST_PROXY:         "true"
      PORT:                "3000"
    expose:
      - "3000"

  postgres:
    image: "pgvector/pgvector:pg16"
    restart: unless-stopped
    environment:
      POSTGRES_USER:     aimanac
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
      POSTGRES_DB:       aimanac
    volumes:
      - aimanac-pg:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U aimanac"]
      interval: 5s
      timeout: 3s
      retries: 10

  redis:
    image: "redis:7-alpine"
    restart: unless-stopped
    volumes:
      - aimanac-redis:/data

  nginx:
    image: "nginx:1.27-alpine"
    restart: unless-stopped
    depends_on:
      - aimanac-server
    ports:
      - "443:443"
      - "80:80"
    volumes:
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./nginx/certs:/etc/nginx/certs:ro

volumes:
  aimanac-pg:
  aimanac-redis:
