# =========================================================
# BreakPilot Core — Shared Infrastructure (Coolify)
# =========================================================
# Deployed via Coolify. SSL termination handled by Traefik.
# Network: breakpilot-network (shared across all 3 repos)
# =========================================================

networks:
  breakpilot-network:
    name: breakpilot-network
    driver: bridge

volumes:
  breakpilot_db_data:
  valkey_data:
  qdrant_data:
  minio_data:
  synapse_data:
  synapse_db_data:
  jitsi_web_config:
  jitsi_web_crontabs:
  jitsi_transcripts:
  jitsi_prosody_config:
  jitsi_prosody_plugins:
  jitsi_jicofo_config:
  jitsi_jvb_config:
  voice_session_data:
  embedding_models:

services:

  # =========================================================
  # DATABASES
  # =========================================================
  postgres:
    image: postgis/postgis:16-3.4-alpine
    container_name: bp-core-postgres
    volumes:
      - breakpilot_db_data:/var/lib/postgresql/data
      - ./scripts/init-schemas.sql:/docker-entrypoint-initdb.d/20-init-schemas.sql:ro
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-breakpilot} -d ${POSTGRES_DB:-breakpilot_db}"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - breakpilot-network

  valkey:
    image: valkey/valkey:8-alpine
    container_name: bp-core-valkey
    volumes:
      - valkey_data:/data
    command: valkey-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped
    networks:
      - breakpilot-network

  # =========================================================
  # VECTOR DB & OBJECT STORAGE
  # =========================================================
  qdrant:
    image: qdrant/qdrant:v1.12.1
    container_name: bp-core-qdrant
    volumes:
      - qdrant_data:/qdrant/storage
    environment:
      QDRANT__SERVICE__GRPC_PORT: 6334
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/127.0.0.1/6333'"]
      interval: 10s
      timeout: 5s
      retries: 3
    restart: unless-stopped
    networks:
      - breakpilot-network

  minio:
    image: minio/minio:latest
    container_name: bp-core-minio
    volumes:
      - minio_data:/data
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    command: server /data --console-address ":9001"
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.minio-console.rule=Host(`minio.breakpilot.ai`)"
      - "traefik.http.routers.minio-console.entrypoints=https"
      - "traefik.http.routers.minio-console.tls=true"
      - "traefik.http.routers.minio-console.tls.certresolver=letsencrypt"
      - "traefik.http.services.minio-console.loadbalancer.server.port=9001"
    restart: unless-stopped
    networks:
      - breakpilot-network

  # =========================================================
  # SHARED SERVICES
  # =========================================================
  backend-core:
    build:
      context: ./backend-core
      dockerfile: Dockerfile
    container_name: bp-core-backend
    expose:
      - "8000"
    environment:
      DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?options=-csearch_path%3Dcore,public
      JWT_SECRET: ${JWT_SECRET}
      ENVIRONMENT: production
      VALKEY_URL: redis://valkey:6379/0
      SESSION_TTL_HOURS: ${SESSION_TTL_HOURS:-24}
      CONSENT_SERVICE_URL: http://consent-service:8081
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME}
      SMTP_PASSWORD: ${SMTP_PASSWORD}
      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-BreakPilot}
      SMTP_FROM_ADDR: ${SMTP_FROM_ADDR:-noreply@breakpilot.ai}
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
      consent-service:
        condition: service_started
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.backend-core.rule=Host(`api-core.breakpilot.ai`)"
      - "traefik.http.routers.backend-core.entrypoints=https"
      - "traefik.http.routers.backend-core.tls=true"
      - "traefik.http.routers.backend-core.tls.certresolver=letsencrypt"
      - "traefik.http.services.backend-core.loadbalancer.server.port=8000"
    restart: unless-stopped
    networks:
      - breakpilot-network

  consent-service:
    build:
      context: ./consent-service
      dockerfile: Dockerfile
    container_name: bp-core-consent-service
    expose:
      - "8081"
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      JWT_SECRET: ${JWT_SECRET}
      JWT_REFRESH_SECRET: ${JWT_REFRESH_SECRET}
      PORT: 8081
      ENVIRONMENT: production
      ALLOWED_ORIGINS: "*"
      VALKEY_URL: redis://valkey:6379/0
      SESSION_TTL_HOURS: ${SESSION_TTL_HOURS:-24}
      SMTP_HOST: ${SMTP_HOST}
      SMTP_PORT: ${SMTP_PORT:-587}
      SMTP_USERNAME: ${SMTP_USERNAME}
      SMTP_PASSWORD: ${SMTP_PASSWORD}
      SMTP_FROM_NAME: ${SMTP_FROM_NAME:-BreakPilot}
      SMTP_FROM_ADDR: ${SMTP_FROM_ADDR:-noreply@breakpilot.ai}
      FRONTEND_URL: ${FRONTEND_URL:-https://www.breakpilot.ai}
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - breakpilot-network

  billing-service:
    build:
      context: ./billing-service
      dockerfile: Dockerfile
    container_name: bp-core-billing-service
    expose:
      - "8083"
    environment:
      DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      JWT_SECRET: ${JWT_SECRET}
      PORT: 8083
      ENVIRONMENT: production
      ALLOWED_ORIGINS: "*"
      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY}
      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET}
      STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY}
      BILLING_SUCCESS_URL: ${BILLING_SUCCESS_URL:-https://www.breakpilot.ai/billing/success}
      BILLING_CANCEL_URL: ${BILLING_CANCEL_URL:-https://www.breakpilot.ai/billing/cancel}
      FRONTEND_URL: ${FRONTEND_URL:-https://www.breakpilot.ai}
      TRIAL_PERIOD_DAYS: ${TRIAL_PERIOD_DAYS:-14}
      INTERNAL_API_KEY: ${INTERNAL_API_KEY}
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - breakpilot-network

  # =========================================================
  # RAG & EMBEDDING SERVICES
  # =========================================================
  rag-service:
    build:
      context: ./rag-service
      dockerfile: Dockerfile
    container_name: bp-core-rag-service
    expose:
      - "8097"
    environment:
      PORT: 8097
      QDRANT_URL: http://qdrant:6333
      MINIO_ENDPOINT: minio:9000
      MINIO_ACCESS_KEY: ${MINIO_ROOT_USER}
      MINIO_SECRET_KEY: ${MINIO_ROOT_PASSWORD}
      MINIO_BUCKET: ${MINIO_BUCKET:-breakpilot-rag}
      MINIO_SECURE: "false"
      EMBEDDING_SERVICE_URL: http://embedding-service:8087
      JWT_SECRET: ${JWT_SECRET}
      ENVIRONMENT: production
    depends_on:
      qdrant:
        condition: service_healthy
      minio:
        condition: service_healthy
      embedding-service:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:8097/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    restart: unless-stopped
    networks:
      - breakpilot-network

  embedding-service:
    build:
      context: ./embedding-service
      dockerfile: Dockerfile
    container_name: bp-core-embedding-service
    volumes:
      - embedding_models:/root/.cache/huggingface
    environment:
      EMBEDDING_BACKEND: ${EMBEDDING_BACKEND:-local}
      LOCAL_EMBEDDING_MODEL: ${LOCAL_EMBEDDING_MODEL:-sentence-transformers/all-MiniLM-L6-v2}
      LOCAL_RERANKER_MODEL: ${LOCAL_RERANKER_MODEL:-cross-encoder/ms-marco-MiniLM-L-6-v2}
      PDF_EXTRACTION_BACKEND: ${PDF_EXTRACTION_BACKEND:-pymupdf}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      COHERE_API_KEY: ${COHERE_API_KEY:-}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
    deploy:
      resources:
        limits:
          memory: 4G
    healthcheck:
      test: ["CMD", "python", "-c", "import httpx; r=httpx.get('http://127.0.0.1:8087/health'); r.raise_for_status()"]
      interval: 30s
      timeout: 10s
      start_period: 120s
      retries: 3
    restart: unless-stopped
    networks:
      - breakpilot-network

  # =========================================================
  # HEALTH AGGREGATOR
  # =========================================================
  health-aggregator:
    build:
      context: ./scripts
      dockerfile: Dockerfile.health
    container_name: bp-core-health
    expose:
      - "8099"
    environment:
      PORT: 8099
      CHECK_SERVICES: "postgres:5432,valkey:6379,qdrant:6333,minio:9000,backend-core:8000,rag-service:8097,embedding-service:8087,voice-service:8091"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:8099/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.health.rule=Host(`health.breakpilot.ai`)"
      - "traefik.http.routers.health.entrypoints=https"
      - "traefik.http.routers.health.tls=true"
      - "traefik.http.routers.health.tls.certresolver=letsencrypt"
      - "traefik.http.services.health.loadbalancer.server.port=8099"
    restart: unless-stopped
    networks:
      - breakpilot-network

  # =========================================================
  # VOICE SERVICE
  # =========================================================
  voice-service:
    build:
      context: ./voice-service
      dockerfile: Dockerfile
    container_name: bp-core-voice-service
    expose:
      - "8091"
    volumes:
      - voice_session_data:/app/data/sessions
    environment:
      PORT: 8091
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      VALKEY_URL: redis://valkey:6379/0
      KLAUSUR_SERVICE_URL: http://bp-lehrer-klausur-service:8086
      OLLAMA_BASE_URL: ${OLLAMA_BASE_URL:-}
      OLLAMA_VOICE_MODEL: ${OLLAMA_VOICE_MODEL:-}
      ENVIRONMENT: production
      JWT_SECRET: ${JWT_SECRET}
    depends_on:
      postgres:
        condition: service_healthy
      valkey:
        condition: service_started
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:8091/health"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 3
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.voice.rule=Host(`voice.breakpilot.ai`)"
      - "traefik.http.routers.voice.entrypoints=https"
      - "traefik.http.routers.voice.tls=true"
      - "traefik.http.routers.voice.tls.certresolver=letsencrypt"
      - "traefik.http.services.voice.loadbalancer.server.port=8091"
    restart: unless-stopped
    networks:
      - breakpilot-network

  # =========================================================
  # NIGHT SCHEDULER
  # =========================================================
  night-scheduler:
    build:
      context: ./night-scheduler
      dockerfile: Dockerfile
    container_name: bp-core-night-scheduler
    expose:
      - "8096"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./night-scheduler/config:/config
    environment:
      COMPOSE_PROJECT_NAME: breakpilot-core
      CONTAINER_PATTERN: "bp-*"
      EXCLUDED_CONTAINERS: "bp-core-night-scheduler,bp-core-postgres,bp-core-valkey"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:8096/health"]
      interval: 30s
      timeout: 10s
      start_period: 10s
      retries: 3
    restart: unless-stopped
    networks:
      - breakpilot-network

  # =========================================================
  # ADMIN CORE
  # =========================================================
  admin-core:
    build:
      context: ./admin-core
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_CORE_API_URL:-https://api-core.breakpilot.ai}
    container_name: bp-core-admin
    expose:
      - "3000"
    environment:
      NODE_ENV: production
      BACKEND_URL: http://backend-core:8000
      OLLAMA_URL: ${OLLAMA_URL:-}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.admin-core.rule=Host(`admin-core.breakpilot.ai`)"
      - "traefik.http.routers.admin-core.entrypoints=https"
      - "traefik.http.routers.admin-core.tls=true"
      - "traefik.http.routers.admin-core.tls.certresolver=letsencrypt"
      - "traefik.http.services.admin-core.loadbalancer.server.port=3000"
    restart: unless-stopped
    networks:
      - breakpilot-network

  # =========================================================
  # COMMUNICATION — Matrix/Synapse
  # =========================================================
  synapse-db:
    image: postgres:16-alpine
    container_name: bp-core-synapse-db
    environment:
      POSTGRES_USER: synapse
      POSTGRES_PASSWORD: ${SYNAPSE_DB_PASSWORD}
      POSTGRES_DB: synapse
      POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
    volumes:
      - synapse_db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U synapse"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped
    networks:
      - breakpilot-network

  synapse:
    image: matrixdotorg/synapse:latest
    container_name: bp-core-synapse
    volumes:
      - synapse_data:/data
    environment:
      SYNAPSE_SERVER_NAME: ${SYNAPSE_SERVER_NAME:-chat.breakpilot.ai}
      SYNAPSE_REPORT_STATS: "no"
      SYNAPSE_NO_TLS: "true"
      SYNAPSE_ENABLE_REGISTRATION: ${SYNAPSE_ENABLE_REGISTRATION:-false}
      SYNAPSE_LOG_LEVEL: ${SYNAPSE_LOG_LEVEL:-WARNING}
      UID: "1000"
      GID: "1000"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:8008/health"]
      interval: 30s
      timeout: 10s
      start_period: 30s
      retries: 3
    depends_on:
      synapse-db:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.synapse.rule=Host(`chat.breakpilot.ai`)"
      - "traefik.http.routers.synapse.entrypoints=https"
      - "traefik.http.routers.synapse.tls=true"
      - "traefik.http.routers.synapse.tls.certresolver=letsencrypt"
      - "traefik.http.services.synapse.loadbalancer.server.port=8008"
    restart: unless-stopped
    networks:
      - breakpilot-network

  # =========================================================
  # COMMUNICATION — Jitsi Meet
  # =========================================================
  jitsi-web:
    image: jitsi/web:stable-9823
    container_name: bp-core-jitsi-web
    expose:
      - "80"
    volumes:
      - jitsi_web_config:/config
      - jitsi_web_crontabs:/var/spool/cron/crontabs
      - jitsi_transcripts:/usr/share/jitsi-meet/transcripts
    environment:
      ENABLE_XMPP_WEBSOCKET: "true"
      ENABLE_COLIBRI_WEBSOCKET: "true"
      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
      XMPP_BOSH_URL_BASE: http://jitsi-xmpp:5280
      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
      XMPP_GUEST_DOMAIN: ${XMPP_GUEST_DOMAIN:-guest.meet.jitsi}
      TZ: ${TZ:-Europe/Berlin}
      PUBLIC_URL: https://meet.breakpilot.ai
      JICOFO_AUTH_USER: focus
      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
      ENABLE_GUESTS: "true"
      ENABLE_RECORDING: "false"
      ENABLE_LIVESTREAMING: "false"
      DISABLE_HTTPS: "true"
      APP_NAME: "BreakPilot Meet"
      NATIVE_APP_NAME: "BreakPilot Meet"
      PROVIDER_NAME: "BreakPilot"
    depends_on:
      - jitsi-xmpp
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jitsi.rule=Host(`meet.breakpilot.ai`)"
      - "traefik.http.routers.jitsi.entrypoints=https"
      - "traefik.http.routers.jitsi.tls=true"
      - "traefik.http.routers.jitsi.tls.certresolver=letsencrypt"
      - "traefik.http.services.jitsi.loadbalancer.server.port=80"
    networks:
      breakpilot-network:
        aliases:
          - meet.jitsi

  jitsi-xmpp:
    image: jitsi/prosody:stable-9823
    container_name: bp-core-jitsi-xmpp
    volumes:
      - jitsi_prosody_config:/config
      - jitsi_prosody_plugins:/prosody-plugins-custom
    environment:
      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
      XMPP_GUEST_DOMAIN: ${XMPP_GUEST_DOMAIN:-guest.meet.jitsi}
      XMPP_RECORDER_DOMAIN: ${XMPP_RECORDER_DOMAIN:-recorder.meet.jitsi}
      XMPP_CROSS_DOMAIN: "true"
      TZ: ${TZ:-Europe/Berlin}
      JICOFO_AUTH_USER: focus
      JICOFO_AUTH_PASSWORD: ${JICOFO_AUTH_PASSWORD}
      JVB_AUTH_USER: jvb
      JVB_AUTH_PASSWORD: ${JVB_AUTH_PASSWORD}
      LOG_LEVEL: ${XMPP_LOG_LEVEL:-warn}
      PUBLIC_URL: https://meet.breakpilot.ai
      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
      ENABLE_GUESTS: "true"
    restart: unless-stopped
    networks:
      breakpilot-network:
        aliases:
          - xmpp.meet.jitsi

  jitsi-jicofo:
    image: jitsi/jicofo:stable-9823
    container_name: bp-core-jitsi-jicofo
    volumes:
      - jitsi_jicofo_config:/config
    environment:
      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
      XMPP_MUC_DOMAIN: ${XMPP_MUC_DOMAIN:-muc.meet.jitsi}
      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
      XMPP_SERVER: jitsi-xmpp
      JICOFO_AUTH_USER: focus
      JICOFO_AUTH_PASSWORD: ${JICOFO_AUTH_PASSWORD}
      TZ: ${TZ:-Europe/Berlin}
      ENABLE_AUTH: ${JITSI_ENABLE_AUTH:-false}
      AUTH_TYPE: internal
      ENABLE_AUTO_OWNER: "true"
    depends_on:
      - jitsi-xmpp
    restart: unless-stopped
    networks:
      - breakpilot-network

  jitsi-jvb:
    image: jitsi/jvb:stable-9823
    container_name: bp-core-jitsi-jvb
    ports:
      - "10000:10000/udp"
    volumes:
      - jitsi_jvb_config:/config
    environment:
      XMPP_DOMAIN: ${XMPP_DOMAIN:-meet.jitsi}
      XMPP_AUTH_DOMAIN: ${XMPP_AUTH_DOMAIN:-auth.meet.jitsi}
      XMPP_INTERNAL_MUC_DOMAIN: ${XMPP_INTERNAL_MUC_DOMAIN:-internal-muc.meet.jitsi}
      XMPP_SERVER: jitsi-xmpp
      JVB_AUTH_USER: jvb
      JVB_AUTH_PASSWORD: ${JVB_AUTH_PASSWORD}
      JVB_PORT: 10000
      JVB_STUN_SERVERS: ${JVB_STUN_SERVERS:-stun.l.google.com:19302}
      TZ: ${TZ:-Europe/Berlin}
      PUBLIC_URL: https://meet.breakpilot.ai
      COLIBRI_REST_ENABLED: "true"
      ENABLE_COLIBRI_WEBSOCKET: "true"
    depends_on:
      - jitsi-xmpp
    restart: unless-stopped
    networks:
      - breakpilot-network