docker-compose.yaml

services:
  # PostgreSQL Database
  postgres:
    image: postgres:15-alpine
    container_name: citis_postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-citis}
      POSTGRES_USER: ${POSTGRES_USER:-citis}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
      POSTGRES_HOST_AUTH_METHOD: ${POSTGRES_HOST_AUTH_METHOD:-md5}
    ports:
      - "127.0.0.1:${POSTGRES_PORT:-5433}:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./logs:/var/log/postgresql
    networks:
      - citis_network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-citis} -d ${POSTGRES_DB:-citis}"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  # Redis Cache & Message Broker
  redis:
    image: redis:7-alpine
    container_name: citis_redis
    restart: unless-stopped
    command: >
      sh -c "
      if [ -n '${REDIS_PASSWORD:-}' ]; then
        redis-server --appendonly yes --requirepass '${REDIS_PASSWORD}'
      else
        redis-server --appendonly yes
      fi
      "
    ports:
      - "127.0.0.1:${REDIS_PORT:-6379}:6379"
    volumes:
      - redis_data:/data
      - ./logs:/var/log/redis
    networks:
      - citis_network
    healthcheck:
      test: >
        sh -c "
        if [ -n '${REDIS_PASSWORD:-}' ]; then
          redis-cli -a '${REDIS_PASSWORD}' ping
        else
          redis-cli ping
        fi
        "
      interval: 30s
      timeout: 10s
      retries: 3

  # ChangeDetection.io - Content Integrity Monitoring
  changedetection:
    image: ghcr.io/dgtlmoon/changedetection.io
    container_name: citis_changedetection
    restart: unless-stopped
    environment:
      # Basic configuration
      PUID: 1000
      PGID: 1000
      
      # Optional: Set API key via environment
      CHANGEDETECTION_API_KEY: ${CHANGEDETECTION_API_KEY:-}
      
      # Optional: Set base URL for external access
      BASE_URL: ${CHANGEDETECTION_EXTERNAL_URL:-}
      
      # Performance tuning - Chrome browser optional for JavaScript sites
      # WEBDRIVER_URL: "http://citis-browser-chrome:4444/wd/hub"
      
      # Security settings
      HIDE_REFERER: "true"
      
    ports:
      - "127.0.0.1:${CHANGEDETECTION_EXTERNAL_PORT:-5001}:5000"  # Bind to localhost only for security
    volumes:
      - changedetection_data:/datastore
      - ./logs:/var/log/changedetection
    networks:
      - citis_network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    profiles:
      - changedetection  # Only start when --profile changedetection is used
    # Remove Chrome dependency for now - ChangeDetection.io can work without browser for basic monitoring

  # Browser for ChangeDetection.io (internal only, no external ports)
  citis-browser-chrome:
    image: selenium/standalone-chrome:4
    container_name: citis_browser_chrome
    restart: unless-stopped
    environment:
      # Basic configuration
      SE_VNC_NO_PASSWORD: 1
      SE_SCREEN_WIDTH: 1920
      SE_SCREEN_HEIGHT: 1080
      SE_SCREEN_DEPTH: 24
      # Optimize for headless operation - use correct environment variables
      SE_OPTS: "--log-level INFO"
      # Chrome-specific options
      SE_NODE_MAX_SESSIONS: 1
      SE_NODE_SESSION_TIMEOUT: 300
    # No external ports - internal Docker network only
    volumes:
      - /dev/shm:/dev/shm
    networks:
      - citis_network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:4444/status"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    profiles:
      - changedetection  # Only start when --profile changedetection is used

  # cit.is Web Application (optional - for full containerized deployment)
  web:
    build: .
    container_name: citis_web
    restart: unless-stopped
    environment:
      # Database Configuration
      DB_TYPE: postgres
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_DB: ${POSTGRES_DB:-citis}
      POSTGRES_USER: ${POSTGRES_USER:-citis}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
      
      # Redis Configuration  
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      REDIS_DB: 0
      
      # Django Settings
      DEBUG: ${DEBUG:-False}
      SECRET_KEY: ${SECRET_KEY}
      ALLOWED_HOSTS: ${ALLOWED_HOSTS:-localhost,127.0.0.1}
      
      # Application Settings
      SERVER_BASE_URL: ${SERVER_BASE_URL:-http://localhost:8000}
      MASTER_API_KEY: ${MASTER_API_KEY}
      MASTER_USER_EMAIL: ${MASTER_USER_EMAIL}
      MASTER_USER_PASSWORD: ${MASTER_USER_PASSWORD}
      
      # Archive Settings
      ARCHIVE_MODE: ${ARCHIVE_MODE:-singlefile}
      SINGLEFILE_EXECUTABLE_PATH: ${SINGLEFILE_EXECUTABLE_PATH:-single-file}
      SINGLEFILE_DATA_PATH: ${SINGLEFILE_DATA_PATH:-/app/archives}
      
      # Email Settings
      EMAIL_HOST: ${EMAIL_HOST:-}
      EMAIL_PORT: ${EMAIL_PORT:-587}
      EMAIL_HOST_USER: ${EMAIL_HOST_USER:-}
      EMAIL_HOST_PASSWORD: ${EMAIL_HOST_PASSWORD:-}
      
      # Stripe Settings
      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:-}
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
      
      # ChangeDetection.io Settings
      CHANGEDETECTION_ENABLED: ${CHANGEDETECTION_ENABLED:-False}
      CHANGEDETECTION_BASE_URL: ${CHANGEDETECTION_INTERNAL_URL:-http://changedetection:5000}
      CHANGEDETECTION_API_KEY: ${CHANGEDETECTION_API_KEY:-}
    ports:
      - "${WEB_PORT:-8000}:8000"
    volumes:
      - ./archives:/app/archives
      - ./media:/app/media
      - ./staticfiles:/app/staticfiles
      - ./logs:/app/logs
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - citis_network
    profiles:
      - full-stack  # Only start with --profile full-stack

  # Celery Worker (optional - for full containerized deployment)
  celery:
    build: .
    container_name: citis_celery
    restart: unless-stopped
    command: celery -A citis worker --loglevel=info --concurrency=4 --queues=archive,assets,analytics,celery
    environment:
      # Same environment as web service
      DB_TYPE: postgres
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_DB: ${POSTGRES_DB:-citis}
      POSTGRES_USER: ${POSTGRES_USER:-citis}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      REDIS_DB: 0
      SECRET_KEY: ${SECRET_KEY}
      DEBUG: ${DEBUG:-False}
      MASTER_API_KEY: ${MASTER_API_KEY}
      SINGLEFILE_EXECUTABLE_PATH: ${SINGLEFILE_EXECUTABLE_PATH:-single-file}
      SINGLEFILE_DATA_PATH: ${SINGLEFILE_DATA_PATH:-/app/archives}
      # ChangeDetection.io Settings
      CHANGEDETECTION_ENABLED: ${CHANGEDETECTION_ENABLED:-False}
      CHANGEDETECTION_BASE_URL: ${CHANGEDETECTION_INTERNAL_URL:-http://changedetection:5000}
      CHANGEDETECTION_API_KEY: ${CHANGEDETECTION_API_KEY:-}
    volumes:
      - ./archives:/app/archives
      - ./logs:/app/logs
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - citis_network
    profiles:
      - full-stack  # Only start with --profile full-stack

  # Celery Beat Scheduler (optional - for full containerized deployment)
  celery-beat:
    build: .
    container_name: citis_celery_beat
    restart: unless-stopped
    command: celery -A citis beat --loglevel=info --scheduler=django_celery_beat.schedulers:DatabaseScheduler
    environment:
      # Same environment as web service
      DB_TYPE: postgres
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_DB: ${POSTGRES_DB:-citis}
      POSTGRES_USER: ${POSTGRES_USER:-citis}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-}
      REDIS_DB: 0
      SECRET_KEY: ${SECRET_KEY}
      DEBUG: ${DEBUG:-False}
      MASTER_API_KEY: ${MASTER_API_KEY}
      # ChangeDetection.io Settings  
      CHANGEDETECTION_ENABLED: ${CHANGEDETECTION_ENABLED:-False}
      CHANGEDETECTION_BASE_URL: ${CHANGEDETECTION_INTERNAL_URL:-http://changedetection:5000}
      CHANGEDETECTION_API_KEY: ${CHANGEDETECTION_API_KEY:-}
    volumes:
      - ./logs:/app/logs
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - citis_network
    profiles:
      - full-stack  # Only start with --profile full-stack

# Named volumes for data persistence
volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local
  changedetection_data:
    driver: local

# Network for service communication
networks:
  citis_network:
    driver: bridge