docker-compose.prod.deploy.yml

services:
  # Traefik reverse proxy
  traefik:
    image: traefik:v2.10
    container_name: ai-hr-traefik
    command:
      # prod:
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@aihr.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--api.dashboard=true"
      - "--log.level=INFO"
    ports:
      - "80:80" # HTTP
      - "443:443" # HTTPS
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/ubuntu/srv/app/letsencrypt:/letsencrypt
    networks:
      - ai-hr-network

  # PostgreSQL database
  postgresql:
    image: ghcr.io/${GHCR_USER}/${GHCR_REPO}-postgresql:${GHCR_TAG:-latest}
    container_name: ai-hr-postgres
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_USER=${DB_USERNAME:-postgres}
      - POSTGRES_PASSWORD=${DB_PASSWORD:-postgres}
    volumes:
      - ai-hr-postgres-data:/var/lib/postgresql/data
    networks:
      - ai-hr-network
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "PGPASSWORD=$$POSTGRES_PASSWORD psql -U $$POSTGRES_USER -d postgres -tAc \"SELECT 1 FROM pg_database WHERE datname='ai_db';\" | grep -q 1"
        ]
      interval: 10s
      timeout: 5s
      retries: 5
    labels:
      - "traefik.enable=false"

  # Authentication service
  service-auth:
    image: ghcr.io/${GHCR_USER}/${GHCR_REPO}-service-auth:${GHCR_TAG:-latest}
    container_name: ai-hr-auth
    depends_on:
      postgresql:
        condition: service_healthy
    networks:
      - ai-hr-network
    environment:
      - SERVER_PORT=${AUTH_SERVER_PORT:-8080}
      - DB_HOST=${DB_HOST:-postgresql}
      - DB_PORT=${DB_PORT:-5432}
      - DB_USERNAME=${DB_USERNAME:-postgres}
      - DB_PASSWORD=${DB_PASSWORD:-postgres}
      - JWT_PRIVATE_KEY=${JWT_PRIVATE_KEY:------BEGIN PRIVATE KEY-----MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCqDezswS8yNAoZHLUF3oE/dnvH3Z1Jga80GJr7mv45dQNdnkzYLFtq87hb/ocIZoiE87fgprejQPDeC732gtfcEJxqHPtYIJDe4Db+bsPRDm7lKBQOchef0wYilH57mgG/iia5nYH61naq0qmHJdFeRYzRCxpQR3n9EXXomV5gfvxLZZZtNk1Up4oTDzRLsTT2OVAlLR2ccYqeS55PcK7ny1M1EeXOBEo4OMfkwdc4f+n2osRNRfLInIlCvOToChxWX8knYmVMWl8afnvSqo6NJCTg0A3RMcEic7+gdTgRSuA9dzkWlymRwUgWhMDMkDS6l7TFIwx9tIT2dp6JYO3DAgMBAAECggEAVPFfx2M4D/uuj5ynT6c1KF4mtk8cofsFaSBhSgzBsDGi3MCV4eVGRMY48LrS+H8+8ipLTwv37rQhnMiAuwHgkSw69UZExmB9/NZCohTx+xsaiZzbZ9vVsR/XkK5b/6GN/f8kGNN0ebdmzy0rQTbCvjQ/gqvpGPCbHq36F5WEbu4udzoISi+cDkivDuujs8UfwPBi0MFYo8gvpskjxdvT2AumtTTPF7D2mp+V+QXnGuNoncmptpNRJ+72Q8DNqqLy5ZvLG+EkorpgaCeawd9RGUdYiC58RErkD9inLv/UtzG5emRrzrPqXP9GOsUMQHBoN2yfIgYpGKTHpKVYPZCvAQKBgQDejQtpgZFCh1fcXgXQ74durXFo6iej+0OtvgvgCXZD6N/W8GafCaLdsklQdbnYBMD63URC3646mCMPn8/uGo9rhDCqr0Uru5DsTa7rMbgLl5VR3lenRqSZKrnR8nakJDTMuz70r85g+ZbDNG8eLf4vyhNSVPnJfuMyNhZkH5LvvQKBgQDDnQDXjd3MgfNb8WMUiaN9qoANwl79N9HfAtbO7CTCLPgB5FwqZElJ5hshKD6MlYJY8W/2ynTgA+4aZa+EmgyaO2wMRDe/KnHWoLSECtjWmUbdZgNAW3MQvHGtjqi3B8/gnUM6vh8sDzUBDQnRn1jlWPTRbp5KAvabf7YWGuhrfwKBgQC9nJQVjzPQ5/k+osj3y6yq6pFOnvmpJ+HwvJPnjIg7scRMn8P/Sjl+A3GdYMA3QU2eLzkCdQs/lvGAVVvV9MEvDJBeTDh12zfNbR5T+qdhEQRCnVo3BeQlL5bkPl1A2iw2Jm6sEMGYM+50YE8v+mWwF85Afm/XcglmdVi8c35ATQKBgQC4+b2zGBc2bWhIeHH+GM2+Zr2ixTv37ZILde7VS17TM5zuhRhWifD37Z2X9Ct522OgYedDk12D/JNq6N9Z4CasriZVTyj8H9H4aI1rE6rK+7SUZgQLFq8vk1NYEMAgHEYKHAxX/zMRAexYaxDu5eU1M7KGXTlXuYejsdfo/VbtVwKBgAS9ZEStN17V9N+v4vCb2tnkHagXx/bKOZ9TwG3OjhRofL5mftsVeWMSnofBjQX7fpvQIn/CUREpRGCgivYs6MB79GbemhY7NlSHc+z8y1oHmPxgiizTNTImGLCCgRTS9c58KkGdm1kdkR6IbJe4cExvlndP/IPvJxUQ/WBmdk3M-----END PRIVATE KEY-----}
      - JWT_PUBLIC_KEY=${JWT_PUBLIC_KEY:------BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqg3s7MEvMjQKGRy1Bd6BP3Z7x92dSYGvNBia+5r+OXUDXZ5M2CxbavO4W/6HCGaIhPO34Ka3o0Dw3gu99oLX3BCcahz7WCCQ3uA2/m7D0Q5u5SgUDnIXn9MGIpR+e5oBv4omuZ2B+tZ2qtKphyXRXkWM0QsaUEd5/RF16JleYH78S2WWbTZNVKeKEw80S7E09jlQJS0dnHGKnkueT3Cu58tTNRHlzgRKODjH5MHXOH/p9qLETUXyyJyJQrzk6AocVl/JJ2JlTFpfGn570qqOjSQk4NAN0THBInO/oHU4EUrgPXc5FpcpkcFIFoTAzJA0upe0xSMMfbSE9naeiWDtwwIDAQAB-----END PUBLIC KEY-----}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-"http://localhost:3000,http://localhost:5173,http://localhost:4200"}
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8080/actuator/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.auth.rule=Host(`ec2-34-236-4-221.compute-1.amazonaws.com`) && PathPrefix(`/api/v1/auth`)"
      - "traefik.http.routers.auth.entrypoints=websecure"
      - "traefik.http.services.auth.loadbalancer.server.port=8080"

  # Job management service
  service-job:
    image: ghcr.io/${GHCR_USER}/${GHCR_REPO}-service-job:${GHCR_TAG:-latest}
    container_name: ai-hr-job
    depends_on:
      postgresql:
        condition: service_healthy
    networks:
      - ai-hr-network
    environment:
      - SERVER_PORT=${JOB_SERVER_PORT:-8081}
      - DB_HOST=${DB_HOST:-postgresql}
      - DB_PORT=${DB_PORT:-5432}
      - DB_USERNAME=${DB_USERNAME:-postgres}
      - DB_PASSWORD=${DB_PASSWORD:-postgres}
      - JWT_PUBLIC_KEY=${JWT_PUBLIC_KEY:------BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqg3s7MEvMjQKGRy1Bd6BP3Z7x92dSYGvNBia+5r+OXUDXZ5M2CxbavO4W/6HCGaIhPO34Ka3o0Dw3gu99oLX3BCcahz7WCCQ3uA2/m7D0Q5u5SgUDnIXn9MGIpR+e5oBv4omuZ2B+tZ2qtKphyXRXkWM0QsaUEd5/RF16JleYH78S2WWbTZNVKeKEw80S7E09jlQJS0dnHGKnkueT3Cu58tTNRHlzgRKODjH5MHXOH/p9qLETUXyyJyJQrzk6AocVl/JJ2JlTFpfGn570qqOjSQk4NAN0THBInO/oHU4EUrgPXc5FpcpkcFIFoTAzJA0upe0xSMMfbSE9naeiWDtwwIDAQAB-----END PUBLIC KEY-----}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-"http://localhost:3000,http://localhost:5173,http://localhost:4200"}
      - AUTH_BASE_URL=${AUTH_BASE_URL:-http://service-auth:8080}
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8081/actuator/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.job.rule=Host(`ec2-34-236-4-221.compute-1.amazonaws.com`) && PathPrefix(`/api/v1/jobs`)"
      - "traefik.http.routers.job.entrypoints=websecure"
      - "traefik.http.services.job.loadbalancer.server.port=8081"

  # Application management service
  service-application:
    image: ghcr.io/${GHCR_USER}/${GHCR_REPO}-service-application:${GHCR_TAG:-latest}
    container_name: ai-hr-application
    depends_on:
      postgresql:
        condition: service_healthy
    networks:
      - ai-hr-network
    environment:
      - SERVER_PORT=${APPLICATION_SERVER_PORT:-8082}
      - DB_HOST=${DB_HOST:-postgresql}
      - DB_PORT=${DB_PORT:-5432}
      - DB_USERNAME=${DB_USERNAME:-postgres}
      - DB_PASSWORD=${DB_PASSWORD:-postgres}
      - JWT_PUBLIC_KEY=${JWT_PUBLIC_KEY:------BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqg3s7MEvMjQKGRy1Bd6BP3Z7x92dSYGvNBia+5r+OXUDXZ5M2CxbavO4W/6HCGaIhPO34Ka3o0Dw3gu99oLX3BCcahz7WCCQ3uA2/m7D0Q5u5SgUDnIXn9MGIpR+e5oBv4omuZ2B+tZ2qtKphyXRXkWM0QsaUEd5/RF16JleYH78S2WWbTZNVKeKEw80S7E09jlQJS0dnHGKnkueT3Cu58tTNRHlzgRKODjH5MHXOH/p9qLETUXyyJyJQrzk6AocVl/JJ2JlTFpfGn570qqOjSQk4NAN0THBInO/oHU4EUrgPXc5FpcpkcFIFoTAzJA0upe0xSMMfbSE9naeiWDtwwIDAQAB-----END PUBLIC KEY-----}
      - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-"http://localhost:3000,http://localhost:5173,http://localhost:4200"}
      - GRPC_GEN_AI_SERVICE_HOST=${GRPC_GEN_AI_SERVICE_HOST:-service-genai}
      - GRPC_GEN_AI_SERVICE_PORT=${GRPC_GEN_AI_SERVICE_PORT:-8079}
      - AUTH_BASE_URL=${AUTH_BASE_URL:-http://service-auth:8080}
      - JOB_BASE_URL=${JOB_BASE_URL:-http://service-job:8081}
    volumes:
      - resume-uploads:/app/uploads/resumes
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:8082/actuator/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.application.rule=Host(`ec2-34-236-4-221.compute-1.amazonaws.com`) && (PathPrefix(`/api/v1/applications`) || PathPrefix(`/api/v1/chat`) || PathPrefix(`/api/v1/assessments`) || PathPrefix(`/api/v1/files`))"
      - "traefik.http.routers.application.entrypoints=websecure"
      - "traefik.http.services.application.loadbalancer.server.port=8082"

  # GenAI service
  service-genai:
    image: ghcr.io/${GHCR_USER}/${GHCR_REPO}-service-genai:${GHCR_TAG:-latest}
    container_name: ai-hr-genai
    depends_on:
      postgresql:
        condition: service_healthy
    networks:
      - ai-hr-network
    environment:
      - PYTHONDONTWRITEBYTECODE=1
      - PYTHONUNBUFFERED=1
      - DB_HOST=${DB_HOST:-postgresql}
      - DB_PORT=${DB_PORT:-5432}
      - DB_USERNAME=${DB_USERNAME:-postgres}
      - DB_PASSWORD=${DB_PASSWORD:-postgres}
      - OLLAMA_BASE_URL=${OLLAMA_BASE_URL}
      - OLLAMA_MODEL=${OLLAMA_MODEL}
      - OLLAMA_API_KEY=${OLLAMA_API_KEY}

  # Frontend
  frontend:
    image: ghcr.io/${GHCR_USER}/${GHCR_REPO}-frontend:${GHCR_TAG:-latest}
    container_name: ai-hr-frontend
    networks:
      - ai-hr-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.frontend.rule=Host(`ec2-34-236-4-221.compute-1.amazonaws.com`)"
      - "traefik.http.routers.frontend.entrypoints=websecure"
      - "traefik.http.routers.frontend.tls=true"
      - "traefik.http.routers.frontend.tls.certresolver=letsencrypt"
      - "traefik.http.services.frontend.loadbalancer.server.port=80"

networks:
  ai-hr-network:
    driver: bridge
    name: ai-hr-network

volumes:
  ai-hr-postgres-data:
    driver: local
    name: ai-hr-postgres-data
  resume-uploads:
    driver: local
    name: ai-hr-resume-uploads