---
# Arkindex — déploiement mono-projet sur Coolify (domaine ark.nak0x.dev)
# Routage/TLS délégués au proxy Traefik de Coolify (réseau externe "coolify").
# Réseau interne "ark" pour la communication entre services.

x-restart: &restart
  restart: unless-stopped

services:

  db:
    <<: *restart
    container_name: ark-database
    image: postgis/postgis:17-3.5
    shm_size: '256mb'
    environment:
      POSTGRES_USER: arkindex
      POSTGRES_PASSWORD: ${PG_PASS}
      POSTGRES_DB: arkindex
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U arkindex -d arkindex"]
      interval: 10s
      timeout: 5s
      retries: 10
    mem_limit: 1g
    networks:
      - ark

  redis:
    <<: *restart
    container_name: ark-redis
    image: redis:alpine
    volumes:
      - redisdata:/data
    mem_limit: 256m
    networks:
      - ark

  solr:
    <<: *restart
    container_name: ark-solr
    image: solr:9
    command: ["solr", "-f", "-cloud", "-noprompt"]
    environment:
      SOLR_JAVA_MEM: "-Xms256m -Xmx512m"
    volumes:
      - solrdata:/var/solr
    mem_limit: 768m
    networks:
      - ark

  garage:
    <<: *restart
    container_name: ark-garage
    image: dxflrs/garage:v2.1.0
    volumes:
      - garagedata:/var/lib/garage
      - ./garage.toml:/etc/garage.toml:ro
    mem_limit: 512m
    networks:
      - ark
      - coolify
    labels:
      - traefik.enable=true
      - traefik.docker.network=coolify
      # --- S3 API (virtual-hosted style: un host par bucket) ---
      - traefik.http.routers.ark-s3.entrypoints=https
      - traefik.http.routers.ark-s3.tls=true
      - traefik.http.routers.ark-s3.tls.certresolver=letsencrypt
      - traefik.http.routers.ark-s3.service=ark-s3
      - traefik.http.routers.ark-s3.rule=Host(`s3.ark.nak0x.dev`) || Host(`staging.s3.ark.nak0x.dev`) || Host(`thumbnails.s3.ark.nak0x.dev`) || Host(`export.s3.ark.nak0x.dev`) || Host(`training.s3.ark.nak0x.dev`) || Host(`ponos-logs.s3.ark.nak0x.dev`) || Host(`ponos-artifacts.s3.ark.nak0x.dev`) || Host(`ingest.s3.ark.nak0x.dev`) || Host(`uploads.s3.ark.nak0x.dev`) || Host(`iiif-cache.s3.ark.nak0x.dev`)
      - traefik.http.routers.ark-s3.middlewares=ark-s3-cors
      - traefik.http.services.ark-s3.loadbalancer.server.port=3900
      # CORS: Garage ne gère pas CORS sur l'API S3, on le fait dans Traefik
      - traefik.http.middlewares.ark-s3-cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT,POST,DELETE,HEAD
      - traefik.http.middlewares.ark-s3-cors.headers.accesscontrolallowheaders=*
      - traefik.http.middlewares.ark-s3-cors.headers.accesscontrolalloworiginlist=https://ark.nak0x.dev
      - traefik.http.middlewares.ark-s3-cors.headers.addvaryheader=true
      # http -> https
      - traefik.http.routers.ark-s3-http.entrypoints=http
      - traefik.http.routers.ark-s3-http.rule=Host(`s3.ark.nak0x.dev`) || Host(`staging.s3.ark.nak0x.dev`) || Host(`thumbnails.s3.ark.nak0x.dev`) || Host(`export.s3.ark.nak0x.dev`) || Host(`training.s3.ark.nak0x.dev`) || Host(`ponos-logs.s3.ark.nak0x.dev`) || Host(`ponos-artifacts.s3.ark.nak0x.dev`) || Host(`ingest.s3.ark.nak0x.dev`) || Host(`uploads.s3.ark.nak0x.dev`) || Host(`iiif-cache.s3.ark.nak0x.dev`)
      - traefik.http.routers.ark-s3-http.middlewares=ark-redir-https
      - traefik.http.middlewares.ark-redir-https.redirectscheme.scheme=https

  cantaloupe:
    <<: *restart
    container_name: ark-cantaloupe
    image: registry.gitlab.teklia.com/iiif/cantaloupe:5.0.7
    environment:
      AWS_ACCESS_KEY_ID: ${GK_ID}
      AWS_SECRET_ACCESS_KEY: ${GK_SECRET}
    volumes:
      - ./cantaloupe.properties:/etc/cantaloupe.properties:ro
    depends_on:
      - garage
    mem_limit: 1g
    networks:
      - ark
      - coolify
    labels:
      - traefik.enable=true
      - traefik.docker.network=coolify
      - traefik.http.routers.ark-iiif.entrypoints=https
      - traefik.http.routers.ark-iiif.tls=true
      - traefik.http.routers.ark-iiif.tls.certresolver=letsencrypt
      - traefik.http.routers.ark-iiif.service=ark-iiif
      - traefik.http.routers.ark-iiif.rule=Host(`iiif.ark.nak0x.dev`) || Host(`uploads.iiif.ark.nak0x.dev`) || Host(`ingest.iiif.ark.nak0x.dev`)
      - traefik.http.services.ark-iiif.loadbalancer.server.port=80
      - traefik.http.routers.ark-iiif-http.entrypoints=http
      - traefik.http.routers.ark-iiif-http.rule=Host(`iiif.ark.nak0x.dev`) || Host(`uploads.iiif.ark.nak0x.dev`) || Host(`ingest.iiif.ark.nak0x.dev`)
      - traefik.http.routers.ark-iiif-http.middlewares=ark-redir-https

  backend:
    <<: *restart
    container_name: ark-backend
    image: registry.gitlab.teklia.com/arkindex/backend:1.12.2
    environment:
      CONFIG_PATH: /arkindex.yml
      MAX_WORKERS: "3"
    volumes:
      - ./config.yml:/arkindex.yml:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    healthcheck:
      test: ["CMD-SHELL", "wget --spider --quiet http://localhost:8000/api/v1/health/ || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 10
      start_period: 30s
    mem_limit: 1g
    networks:
      - ark
      - coolify
    labels:
      - traefik.enable=true
      - traefik.docker.network=coolify
      # API / admin / docs / rq / static -> backend (priorité haute)
      - traefik.http.routers.ark-api.entrypoints=https
      - traefik.http.routers.ark-api.tls=true
      - traefik.http.routers.ark-api.tls.certresolver=letsencrypt
      - traefik.http.routers.ark-api.priority=100
      - traefik.http.routers.ark-api.rule=Host(`ark.nak0x.dev`) && (PathPrefix(`/api/`) || PathPrefix(`/api-docs/`) || PathPrefix(`/admin/`) || PathPrefix(`/rq/`) || PathPrefix(`/static/`))
      - traefik.http.routers.ark-api.service=ark-api
      - traefik.http.services.ark-api.loadbalancer.server.port=8000
      - traefik.http.routers.ark-api-http.entrypoints=http
      - traefik.http.routers.ark-api-http.priority=100
      - traefik.http.routers.ark-api-http.rule=Host(`ark.nak0x.dev`) && (PathPrefix(`/api/`) || PathPrefix(`/api-docs/`) || PathPrefix(`/admin/`) || PathPrefix(`/rq/`) || PathPrefix(`/static/`))
      - traefik.http.routers.ark-api-http.middlewares=ark-redir-https

  worker:
    <<: *restart
    container_name: ark-worker
    image: registry.gitlab.teklia.com/arkindex/backend:1.12.2
    command: ["arkindex", "rqworker-pool", "--num-workers", "1", "-v", "1", "default", "high", "tasks", "export", "iiif"]
    environment:
      CONFIG_PATH: /arkindex.yml
    # root requis pour accéder au socket Docker (tâches Ponos)
    user: root
    volumes:
      - ./config.yml:/arkindex.yml:ro
      - /tmp:/tmp
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    mem_limit: 1500m
    networks:
      - ark
      - coolify

  front:
    <<: *restart
    container_name: ark-front
    image: registry.gitlab.teklia.com/arkindex/frontend:1.12.2
    depends_on:
      - backend
    mem_limit: 256m
    networks:
      - ark
      - coolify
    labels:
      - traefik.enable=true
      - traefik.docker.network=coolify
      # SPA -> front (catch-all, priorité basse)
      - traefik.http.routers.ark-front.entrypoints=https
      - traefik.http.routers.ark-front.tls=true
      - traefik.http.routers.ark-front.tls.certresolver=letsencrypt
      - traefik.http.routers.ark-front.priority=1
      - traefik.http.routers.ark-front.rule=Host(`ark.nak0x.dev`)
      - traefik.http.routers.ark-front.service=ark-front
      - traefik.http.services.ark-front.loadbalancer.server.port=80
      - traefik.http.routers.ark-front-http.entrypoints=http
      - traefik.http.routers.ark-front-http.priority=1
      - traefik.http.routers.ark-front-http.rule=Host(`ark.nak0x.dev`)
      - traefik.http.routers.ark-front-http.middlewares=ark-redir-https

volumes:
  pgdata:
  redisdata:
  solrdata:
  garagedata:

networks:
  ark:
    name: ark
  coolify:
    external: true