services:
  k3s-server:
    image: rancher/k3s:v1.36.2-k3s1
    container_name: k3s-server
    command:
      - server
      - --tls-san=127.0.0.1
      - --tls-san=k3s-server
      - --tls-san=${K3S_API_HOST:-127.0.0.1}   # внешний IP/домен для доступа к apiserver извне
      - --disable=traefik
    privileged: true
    cgroup: host          # kubelet в cgroup v2 (Ubuntu 22.04+/RedOS)
    restart: unless-stopped
    environment:
      K3S_TOKEN: ${K3S_TOKEN:-supersecrettoken}
      K3S_KUBECONFIG_OUTPUT: /output/kubeconfig.yaml
      K3S_KUBECONFIG_MODE: "644"
    #ports:
    #  - "6443:6443"   # kube-apiserver — доступен извне; ОБЯЗАТЕЛЬНО ограничь фаерволом до доверенных IP
    #  - "80:80"        # ingress http  — задействуются после установки ingress-контроллера
    #  - "443:443"      # ingress https
    volumes:
      - k3s-server-data:/var/lib/rancher/k3s   # etcd/state, образы, манифесты — только named volume
      - ./k3s:/output:z                 # отсюда забираем контекст k8s (:z — SELinux label для RedOS)
    tmpfs:
      - /run
      - /var/run
    ulimits:
      nproc: 65535
      nofile:
        soft: 65535
        hard: 65535
    healthcheck:
      test: ["CMD", "kubectl", "get", "--raw=/readyz"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 30s

  k3s-worker:
    image: rancher/k3s:v1.36.2-k3s1
    container_name: k3s-worker
    command:
      - agent
    privileged: true
    cgroup: host          # kubelet в cgroup v2 (Ubuntu 22.04+/RedOS)
    restart: unless-stopped
    depends_on:
      k3s-server:
        condition: service_healthy
    environment:
      K3S_URL: https://k3s-server:6443
      K3S_TOKEN: ${K3S_TOKEN:-supersecrettoken}
    volumes:
      - k3s-worker-data:/var/lib/rancher/k3s
    tmpfs:
      - /run
      - /var/run
    ulimits:
      nproc: 65535
      nofile:
        soft: 65535
        hard: 65535

  gitea:
    image: gitea/gitea:1.22
    container_name: gitea
    restart: unless-stopped
    environment:
      USER_UID: 1000
      USER_GID: 1000
      GITEA__server__ROOT_URL: ${GITEA_ROOT_URL:-http://localhost:3000/}
      GITEA__server__SSH_PORT: ${GITEA_SSH_PORT:-2222}
    ports:
      - "3000:3000"                       # web UI (80/443 заняты k3s)
      - "${GITEA_SSH_PORT:-2222}:22"      # git over ssh
    volumes:
      - ./gitea-data:/data:z            # :z — SELinux label для RedOS
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:3000/api/healthz"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s

  # ---------------------------------------------------------------------------
  # Инфраструктурные зависимости apps/django (sarex-backend).
  # Django деплоится в k3s и ходит сюда — про связность k3s→compose см. README.
  # Креды/версии взяты из sarex-backend/docker-compose.yaml и apps/django/.env.example.
  # ---------------------------------------------------------------------------
  postgres:
    image: postgres:12-alpine
    container_name: postgres
    restart: unless-stopped
    environment:
      # суперпользователь (администрирование)
      POSTGRES_DB: ${SAREX_POSTGRES_DB:-sarex_db}
      POSTGRES_USER: ${SAREX_POSTGRES_USER:-sarex}
      POSTGRES_PASSWORD: ${SAREX_POSTGRES_PASSWORD:-sarex}
      # роли приложений с паролями — читаются init-скриптом 00-init.sh
      DJANGO_DB: ${SAREX_POSTGRES_DB:-sarex_db}
      DJANGO_DB_USER: ${SAREX_DJANGO_DB_USER:-django}
      DJANGO_DB_PASSWORD: ${SAREX_DJANGO_DB_PASSWORD:-django-secret}
      PROC_DB: ${SAREX_PROCESSING_DB:-workflow_db}
      PROC_DB_USER: ${SAREX_PROCESSING_DB_USER:-processing}
      PROC_DB_PASSWORD: ${SAREX_PROCESSING_DB_PASSWORD:-processing-secret}
    ports:
      - "5432:5432"
    volumes:
      - sarex-postgres-data:/var/lib/postgresql/data
      - ./postgres/initdb:/docker-entrypoint-initdb.d:ro,z   # создаёт workflow_db (только на пустом томе)
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${SAREX_POSTGRES_USER:-sarex} -d ${SAREX_POSTGRES_DB:-sarex_db}"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 10s

  redis:
    image: cr.yandex/crp3ccidau046kdj8g9q/redis:7.0.10
    container_name: redis
    restart: unless-stopped
    command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"]
    ports:
      - "6379:6379"
    volumes:
      - sarex-redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 5s

  rabbitmq:
    image: cr.yandex/crp3ccidau046kdj8g9q/rabbimtq:3.11.23
    container_name: rabbitmq
    restart: unless-stopped
    environment:
      RABBITMQ_VHOST: ${SAREX_RABBITMQ_VHOST:-api}
      RABBITMQ_USERNAME: ${SAREX_RABBITMQ_USER:-rabbit}
      RABBITMQ_PASSWORD: ${SAREX_RABBITMQ_PASSWORD:-rabbit}
      RABBITMQ_DISK_FREE_ABSOLUTE_LIMIT: 200MB
    volumes:
      - sarex-rabbitmq-data:/bitnami/rabbitmq/mnesia
    healthcheck:
      test: ["CMD", "rabbitmq-diagnostics", "-q", "ping"]
      interval: 15s
      timeout: 10s
      retries: 12
      start_period: 30s

  minio:
    image: cr.yandex/crp3ccidau046kdj8g9q/minio:250724
    container_name: minio
    restart: unless-stopped
    command: ["server", "/data", "--console-address", ":9001"]
    environment:
      MINIO_ROOT_USER: ${SAREX_MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${SAREX_MINIO_ROOT_PASSWORD:-minioadmin}
      # Консоль отдаётся через верхний nginx с корня minio-домена
      MINIO_BROWSER_REDIRECT_URL: ${SAREX_MINIO_CONSOLE_URL:-https://minio.sarex.local}
    volumes:
      - sarex-minio-data:/data

  # Одноразовый init: ждёт MinIO и на каждое приложение заводит бакет +
  # отдельного пользователя со scoped-политикой (доступ только к своему бакету).
  minio-init:
    image: cr.yandex/crp3ccidau046kdj8g9q/mc:250724
    depends_on:
      - minio
    entrypoint:
      - /bin/sh
      - -c
      - |
        until mc alias set local http://minio:9000 "$$MINIO_ROOT_USER" "$$MINIO_ROOT_PASSWORD"; do
          echo 'waiting for minio...'; sleep 2;
        done

        # provision <bucket> <user> <password> <policy>
        provision() {
          mc mb -p "local/$$1"
          mc admin user add local "$$2" "$$3"
          printf '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:*"],"Resource":["arn:aws:s3:::%s","arn:aws:s3:::%s/*"]}]}' "$$1" "$$1" > /tmp/policy.json
          mc admin policy create local "$$4" /tmp/policy.json || true
          mc admin policy attach local "$$4" --user "$$2" || true
          echo "bucket $$1 + user $$2 ready"
        }

        provision "$$MINIO_BUCKET"      "$$MINIO_APP_USER"  "$$MINIO_APP_PASSWORD"  "$$MINIO_APP_POLICY"
        provision "$$PROC_MINIO_BUCKET" "$$PROC_MINIO_USER" "$$PROC_MINIO_PASSWORD" "$$PROC_MINIO_POLICY"
        provision "$$MEAS_MINIO_BUCKET" "$$MEAS_MINIO_USER" "$$MEAS_MINIO_PASSWORD" "$$MEAS_MINIO_POLICY"
    environment:
      MINIO_ROOT_USER: ${SAREX_MINIO_ROOT_USER:-minioadmin}
      MINIO_ROOT_PASSWORD: ${SAREX_MINIO_ROOT_PASSWORD:-minioadmin}
      # django
      MINIO_BUCKET: ${SAREX_MINIO_BUCKET:-sarex-media-storage}
      MINIO_APP_USER: ${SAREX_MINIO_APP_USER:-sarex-app}
      MINIO_APP_PASSWORD: ${SAREX_MINIO_APP_PASSWORD:-sarex-app-secret}
      MINIO_APP_POLICY: ${SAREX_MINIO_APP_POLICY:-sarex-app-rw}
      # processing
      PROC_MINIO_BUCKET: ${SAREX_PROCESSING_MINIO_BUCKET:-workflows-storage}
      PROC_MINIO_USER: ${SAREX_PROCESSING_MINIO_USER:-sarex-processing}
      PROC_MINIO_PASSWORD: ${SAREX_PROCESSING_MINIO_PASSWORD:-sarex-processing-secret}
      PROC_MINIO_POLICY: ${SAREX_PROCESSING_MINIO_POLICY:-sarex-processing-rw}
      # measurements
      MEAS_MINIO_BUCKET: ${SAREX_MEASUREMENTS_MINIO_BUCKET:-measurements}
      MEAS_MINIO_USER: ${SAREX_MEASUREMENTS_MINIO_USER:-sarex-measurements}
      MEAS_MINIO_PASSWORD: ${SAREX_MEASUREMENTS_MINIO_PASSWORD:-sarex-measurements-secret}
      MEAS_MINIO_POLICY: ${SAREX_MEASUREMENTS_MINIO_POLICY:-sarex-measurements-rw}
    restart: "no"

  # ---------------------------------------------------------------------------
  # Приложение sarex (backend + celery + frontend).
  # Образы приватные (cr.yandex) — нужен `docker login cr.yandex`.
  # Для локальной сборки backend раскомментируй build (репозиторий — соседний).
  # ---------------------------------------------------------------------------
  backend:
    image: ${SAREX_BACKEND_IMAGE:-cr.yandex/crp3ccidau046kdj8g9q/sarex-backend-dev:latest}
    # build:
    #   context: ../../generic/sarex-backend
    #   dockerfile: Dockerfile
    container_name: sarex-backend
    restart: unless-stopped
    environment: &sarex-backend-env
      ALLOWED_HOSTS: "*"
      DJANGO_SETTINGS_MODULE: config.settings.production
      JWT_PRIVATE_KEY: "JWT"
      JWT_PUBLIC_KEY: "JPK"
      DJANGO_POSTGRES_HOST: postgres
      DJANGO_POSTGRES_DATABASE: ${SAREX_POSTGRES_DB:-sarex_db}
      DJANGO_POSTGRES_USER: ${SAREX_DJANGO_DB_USER:-django}
      DJANGO_POSTGRES_PASSWORD: ${SAREX_DJANGO_DB_PASSWORD:-django-secret}
      DJANGO_REDIS_HOST: redis
      DJANGO_RABBIT_HOSTNAME: rabbitmq
      DJANGO_RABBIT_USER: ${SAREX_RABBITMQ_USER:-rabbit}
      DJANGO_RABBIT_PASS: ${SAREX_RABBITMQ_PASSWORD:-rabbit}
      DJANGO_RABBIT_VHOST: ${SAREX_RABBITMQ_VHOST:-api}
      # S3 / объектное хранилище → MinIO (сервис minio)
      S3_HOST: http://minio:9000
      AWS_S3_ENDPOINT_URL: http://minio:9000
      S3_LOGIN: ${SAREX_MINIO_APP_USER:-sarex-app}
      S3_PASSWORD: ${SAREX_MINIO_APP_PASSWORD:-sarex-app-secret}
      S3_BUCKET: ${SAREX_MINIO_BUCKET:-sarex-media-storage}
      S3_REGION: ${SAREX_MINIO_REGION:-us-east-1}
      # Сервис measurements (MeasurementSettings, env_prefix MEASUREMENTS_)
      MEASUREMENTS_HOST: ${SAREX_MEASUREMENTS_HOST:-http://measurements:8000/}
    tty: true
    ports:
      - "8000:8000"   # HTTP API (uWSGI), migrate выполняется в entrypoint
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully

  celery:
    image: ${SAREX_BACKEND_IMAGE:-cr.yandex/crp3ccidau046kdj8g9q/sarex-backend-dev:latest}
    container_name: sarex-celery
    restart: unless-stopped
    entrypoint: celery -A config worker -l info -E -Q default -n default_worker.%h --concurrency=1 -B
    environment:
      <<: *sarex-backend-env
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      minio-init:
        condition: service_completed_successfully

  frontend:
    image: ${SAREX_FRONTEND_IMAGE:-cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:latest}
    container_name: sarex-frontend
    restart: unless-stopped
    ports:
      - "8080:80"     # web UI
    depends_on:
      - backend

  # ---------------------------------------------------------------------------
  # Приложение processing (workflows-api + workflows-frontend).
  # Образы приватные (cr.yandex). БД — отдельная workflow_db в общем postgres.
  # Версии/env взяты из apps/processing/base/*.yaml.
  # ---------------------------------------------------------------------------
  processing-api:
    image: ${SAREX_PROCESSING_API_IMAGE:-cr.yandex/crp3ccidau046kdj8g9q/workflows-api_prod:075fc0}
    container_name: processing-api
    restart: unless-stopped
    entrypoint: ["/httpserver"]
    command: ["migrate"]          # в манифесте: /httpserver migrate (миграции + сервер на :8080)
    environment:
      HTTP_HOST: 0.0.0.0:8080
      POSTGRES_ADDRESS: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DB: ${SAREX_PROCESSING_DB:-workflow_db}
      POSTGRES_USER: ${SAREX_PROCESSING_DB_USER:-processing}
      POSTGRES_PASSWORD: ${SAREX_PROCESSING_DB_PASSWORD:-processing-secret}
      POSTGRES_POOL_SIZE: "3"
      POSTGRES_SSL_USE: "0"
      ENABLE_SQL_QUERY: "0"
      DJANGO_HOST: http://backend:8000          # django-backend в этом же compose
      PUBLIC_KEY: "JPK"                          # JWT public key (заглушка, как у backend)
    ports:
      - "8081:8080"
    depends_on:
      postgres:
        condition: service_healthy

  processing-frontend:
    image: ${SAREX_PROCESSING_FRONTEND_IMAGE:-cr.yandex/crp3ccidau046kdj8g9q/workflows-frontend:ugok2_85f6ce2c}
    container_name: processing-frontend
    restart: unless-stopped
    ports:
      - "8082:8080"     # web UI (контейнер слушает 8080)
    depends_on:
      - processing-api

  # ---------------------------------------------------------------------------
  # measurements — FastAPI, считает измерения по растрам из S3/MinIO (GDAL vsis3).
  # БД/воркера нет. Обязателен S3_JSON_SETTINGS. Источник: apps/measurements/base.
  # ---------------------------------------------------------------------------
  measurements:
    image: ${SAREX_MEASUREMENTS_IMAGE:-cr.yandex/crp3ccidau046kdj8g9q/measurements:production_a5bb3e84}
    container_name: measurements
    restart: unless-stopped
    entrypoint: ["/opt/entrypoint.sh"]
    environment:
      # host http:// → GDAL переключается на AWS_HTTPS=NO (см. CONFIGURATION.md)
      S3_JSON_SETTINGS: '{"host":"http://minio:9000","login":"${SAREX_MEASUREMENTS_MINIO_USER:-sarex-measurements}","password":"${SAREX_MEASUREMENTS_MINIO_PASSWORD:-sarex-measurements-secret}","verify":false,"buckets":["${SAREX_MEASUREMENTS_MINIO_BUCKET:-measurements}"]}'
      LOG_LEVEL: INFO
      TRACING_USE: "false"
      AUTH: "0"
      DJANGO_HOST: http://backend:8000
    # порт наружу не публикуем — доступ только из backend по http://measurements:8000/
    depends_on:
      minio-init:
        condition: service_completed_successfully

  # Верхний reverse-proxy: 3 домена → платформа / rabbitmq (admin) / minio
  nginx:
    image: nginx:1.27-alpine
    container_name: sarex-nginx
    restart: unless-stopped
    ports:
      - "80:80"       # http
      - "443:443"     # https (самоподписанный сертификат)
    environment:
      # подставляются envsubst'ом в шаблон при старте контейнера
      PLATFORM_DOMAIN: ${PLATFORM_DOMAIN:-sarex.local}
      ADMIN_DOMAIN: ${ADMIN_DOMAIN:-admin.sarex.local}
      MINIO_DOMAIN: ${MINIO_DOMAIN:-minio.sarex.local}
    volumes:
      - ./nginx/templates:/etc/nginx/templates:ro,z   # :z — SELinux label для RedOS
      - ./nginx/certs:/etc/nginx/certs:ro,z            # TLS-сертификаты
    depends_on:
      # - backend      # TODO: закомментированы в шаблоне nginx, пока в работе
      # - frontend
      - minio
      - rabbitmq
      - processing-api
      - processing-frontend
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost/healthz"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 10s

volumes:
  k3s-server-data:
  k3s-worker-data:
  gitea-data:
  sarex-postgres-data:
  sarex-redis-data:
  sarex-rabbitmq-data:
  sarex-minio-data: