docker-compose.yml

# Textstack Docker Compose
# Usage: docker compose up -d

services:
  db:
    image: postgres:16
    container_name: textstack_db_prod
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    command:
      - "postgres"
      - "-c"
      - "shared_buffers=256MB"
      - "-c"
      - "work_mem=16MB"
      - "-c"
      - "effective_cache_size=512MB"
      - "-c"
      - "statement_timeout=10000"
    volumes:
      - ./data/postgres-prod:/var/lib/postgresql/data
    # NOTE: No ports exposed - internal only for security
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          memory: 1G
        reservations:
          memory: 256M

  migrator:
    build:
      context: .
      dockerfile: backend/Docker/Migrator.Dockerfile
    container_name: textstack_migrator_prod
    environment:
      ConnectionStrings__Default: "Host=db;Port=5432;Database=${POSTGRES_DB};Username=${POSTGRES_USER};Password=${POSTGRES_PASSWORD}"
    depends_on:
      db:
        condition: service_healthy
    restart: "no"

  api:
    build:
      context: .
      dockerfile: backend/Docker/Api.Dockerfile
    container_name: textstack_api_prod
    environment:
      ASPNETCORE_ENVIRONMENT: ${ASPNETCORE_ENVIRONMENT:-Production}
      ENABLE_TEST_AUTH: ${ENABLE_TEST_AUTH:-false}
      ConnectionStrings__Default: "Host=db;Port=5432;Database=${POSTGRES_DB};Username=${POSTGRES_USER};Password=${POSTGRES_PASSWORD}"
      Storage__RootPath: /storage
      Jwt__SecretKey: ${JWT_SECRET}
      Jwt__Issuer: ${JWT_ISSUER}
      Jwt__Audience: ${JWT_AUDIENCE}
      Google__ClientId: ${GOOGLE_CLIENT_ID}
      Google__LegacyClientIds: ${GOOGLE_LEGACY_CLIENT_IDS:-}
      Search__Provider: ${SEARCH_PROVIDER:-postgres}
      Tts__CachePath: /data/tts-cache
      Explain__CachePath: /data/explain-cache
      Translate__CachePath: /data/translate-cache
      Ollama__BaseUrl: http://ollama:11434
      Ollama__Model: gemma4:e2b
      OpenAI__ApiKey: ${OPENAI_API_KEY:-}
      OpenAI__Model: ${OPENAI_MODEL:-gpt-4.1-nano}
      Resend__ApiKey: ${RESEND_API_KEY:-}
      Resend__FromEmail: ${RESEND_FROM_EMAIL:-noreply@textstack.app}
      Resend__AdminAlertEmail: ${ADMIN_ALERT_EMAIL:-}
      OTEL_EXPORTER_OTLP_ENDPOINT: http://aspire-dashboard:18889
    volumes:
      - ./data/storage:/storage
      - ./data/textstack:/data/textstack
      - ./data/tts-cache:/data/tts-cache
      - ./data/explain-cache:/data/explain-cache
      - ./data/translate-cache:/data/translate-cache
    ports:
      - "127.0.0.1:8080:8080"  # Only localhost, nginx will proxy
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    depends_on:
      db:
        condition: service_healthy
      migrator:
        condition: service_completed_successfully
    deploy:
      resources:
        limits:
          memory: 1G
        reservations:
          memory: 256M

  worker:
    build:
      context: .
      dockerfile: backend/Docker/Worker.Dockerfile
    container_name: textstack_worker_prod
    environment:
      ASPNETCORE_ENVIRONMENT: ${ASPNETCORE_ENVIRONMENT:-Production}
      ConnectionStrings__Default: "Host=db;Port=5432;Database=${POSTGRES_DB};Username=${POSTGRES_USER};Password=${POSTGRES_PASSWORD}"
      Storage__RootPath: /storage
      Search__Provider: ${SEARCH_PROVIDER:-postgres}
      # Worker reaches Ollama via the Docker service name, not localhost
      # (without this override it falls back to appsettings.json's
      # "http://localhost:11434" and silently fails every vocab-enrichment
      # call — symptom: words save with NULL distractors/hint/explanation).
      Ollama__BaseUrl: http://ollama:11434
      Ollama__Model: gemma4:e2b
      OTEL_EXPORTER_OTLP_ENDPOINT: http://aspire-dashboard:18889
    volumes:
      - ./data/storage:/storage
    restart: always
    healthcheck:
      # HeartbeatWorker writes /tmp/worker-alive every 30s. 2min grace covers
      # GC pauses and brief ingestion stalls without false-negatives.
      test: ["CMD-SHELL", "find /tmp/worker-alive -mmin -2 | grep -q ."]
      interval: 60s
      timeout: 5s
      retries: 3
      start_period: 30s
    depends_on:
      db:
        condition: service_healthy
      migrator:
        condition: service_completed_successfully
    deploy:
      resources:
        limits:
          memory: 2G  # Worker needs more for book processing
        reservations:
          memory: 512M

  admin:
    build:
      context: ./apps/admin
      dockerfile: Dockerfile
    container_name: textstack_admin_prod
    environment:
      VITE_API_URL: /api
    ports:
      - "127.0.0.1:81:81"  # Only localhost - not exposed to internet
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:81/ > /dev/null || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    depends_on:
      - api
    deploy:
      resources:
        limits:
          memory: 256M
        reservations:
          memory: 64M

  # ===========================================
  # SSG Worker - prerenders SEO pages
  # ===========================================

  ssg-worker:
    build:
      context: ./apps/web
      dockerfile: Dockerfile.ssg-worker
    container_name: textstack_ssg_worker
    # tini reaps Chromium/chrome_crashpad children left behind by Puppeteer.
    # Without this, each prerender leaves a <defunct> Z process on the host
    # (28 chromium + 28 crashpad zombies observed over a few hours of SSG
    # activity). Doesn't change behaviour, just keeps the process table clean.
    init: true
    environment:
      DATABASE_URL: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}"
      API_URL: http://api:8080
      API_HOST: localhost
      POLL_INTERVAL: "5000"
      INDEXNOW_KEY: ${INDEXNOW_KEY:-}
      INDEXNOW_ENABLED: ${INDEXNOW_ENABLED:-false}
    volumes:
      - ./apps/web/dist:/app/dist
    restart: always
    healthcheck:
      # ssg-worker.mjs writes /tmp/ssg-worker-alive every 30s.
      test: ["CMD-SHELL", "find /tmp/ssg-worker-alive -mmin -2 | grep -q ."]
      interval: 60s
      timeout: 5s
      retries: 3
      start_period: 30s
    depends_on:
      api:
        condition: service_healthy
      db:
        condition: service_healthy
    deploy:
      resources:
        limits:
          memory: 2G
        reservations:
          memory: 512M

  # ===========================================
  # Observability - Aspire Dashboard (all-in-one: traces, logs, metrics)
  # ===========================================

  aspire-dashboard:
    image: mcr.microsoft.com/dotnet/aspire-dashboard:latest
    container_name: textstack_aspire_prod
    profiles: ["observability"]
    ports:
      - "127.0.0.1:18888:18888"   # Dashboard UI (localhost only)
    environment:
      # Auth mode for all endpoints (Aspire 13.x+)
      - Dashboard__Frontend__AuthMode=Unsecured
      - Dashboard__Otlp__AuthMode=Unsecured
      # Telemetry limits
      - Dashboard__TelemetryLimits__MaxLogCount=100000
      - Dashboard__TelemetryLimits__MaxTraceCount=50000
      - Dashboard__TelemetryLimits__MaxMetricCount=100000
    restart: always
    deploy:
      resources:
        limits:
          memory: 1G
        reservations:
          memory: 256M

  # ===========================================
  # Ollama - Local LLM for vocabulary distractors
  # ===========================================

  ollama:
    image: ollama/ollama:0.23.1
    container_name: textstack_ollama
    # GPU access (NVIDIA runtime + device reservation) lives in
    # docker-compose.gpu.yml and is layered on top of this file only by the
    # production deploy (CI runners don't have nvidia-container-toolkit, so
    # `runtime: nvidia` here would break integration tests).
    volumes:
      - ./data/ollama:/root/.ollama
    environment:
      OLLAMA_KEEP_ALIVE: "-1"
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "ollama list >/dev/null 2>&1 || exit 1"]
      interval: 15s
      timeout: 10s
      retries: 5
      start_period: 15s
    deploy:
      resources:
        limits:
          memory: 12G
        reservations:
          memory: 8G