docker-compose.yml

services:
  postgres:
    image: postgres:16-alpine
    container_name: safefam-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB:-safefam}
      POSTGRES_USER: ${POSTGRES_USER:?POSTGRES_USER is required}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
    volumes:
      - ${POSTGRES_DATA_PATH:-/opt/safefam/volumes/postgres}:/var/lib/postgresql/data
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-safefam}"
        ]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - safefam-network

  rabbitmq:
    image: rabbitmq:4-management
    container_name: safefam-rabbitmq
    restart: unless-stopped
    environment:
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_USERNAME:?RABBITMQ_USERNAME is required}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD:?RABBITMQ_PASSWORD is required}
    volumes:
      - ${RABBITMQ_DATA_PATH:-/opt/safefam/volumes/rabbitmq}:/var/lib/rabbitmq
    healthcheck:
      test:
        [
          "CMD",
          "rabbitmq-diagnostics",
          "-q",
          "ping"
        ]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - safefam-network

  redis:
    image: redis:7-alpine
    container_name: safefam-redis
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
    volumes:
      - ${REDIS_DATA_PATH:-/opt/safefam/volumes/redis}:/data
    healthcheck:
      test: [ "CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping" ]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - safefam-network

  spring-backend:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: safefam-spring-server
    restart: unless-stopped
    environment:
      SPRING_PROFILES_ACTIVE: prod

      DB_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB:-safefam}
      DB_USERNAME: ${POSTGRES_USER:?POSTGRES_USER is required}
      DB_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}

      RABBITMQ_URL: ${RABBITMQ_URL:?RABBITMQ_URL is required}
      RABBITMQ_HOST: rabbitmq
      RABBITMQ_PORT: 5672
      RABBITMQ_USERNAME: ${RABBITMQ_USERNAME}
      RABBITMQ_PASSWORD: ${RABBITMQ_PASSWORD}

      ANALYSIS_PUBLISHER_ENABLED: "${ANALYSIS_PUBLISHER_ENABLED:-true}"
      ANALYSIS_CONSUMER_ENABLED: "${ANALYSIS_CONSUMER_ENABLED:-true}"

      AI_CHAT_BASE_URL: ${AI_CHAT_BASE_URL:-http://fastapi-ai:8000}
      AI_CHAT_CONNECT_TIMEOUT: ${AI_CHAT_CONNECT_TIMEOUT:-3s}
      AI_CHAT_READ_TIMEOUT: ${AI_CHAT_READ_TIMEOUT:-60s}

      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
      JWT_ACCESS_TOKEN_EXPIRATION: ${JWT_ACCESS_TOKEN_EXPIRATION:-1800000}
      JWT_REFRESH_TOKEN_EXPIRATION: ${JWT_REFRESH_TOKEN_EXPIRATION:-604800000}

      OUTBOX_ENCRYPTION_KEY_BASE64: ${OUTBOX_ENCRYPTION_KEY_BASE64:?OUTBOX_ENCRYPTION_KEY_BASE64 is required}

      KAKAO_CLIENT_ID: ${KAKAO_CLIENT_ID}
      SOLAPI_API_KEY: ${SOLAPI_API_KEY}
      SOLAPI_API_SECRET: ${SOLAPI_API_SECRET}
      SOLAPI_SENDER: ${SOLAPI_SENDER}

      FIREBASE_ENABLED: "true"
      FIREBASE_SERVICE_ACCOUNT_PATH: /run/secrets/firebase/service-account.json
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
    volumes:
      - ${FIREBASE_SERVICE_ACCOUNT_HOST_PATH:?FIREBASE_SERVICE_ACCOUNT_HOST_PATH is required}:/run/secrets/firebase/service-account.json:ro
    ports:
      # 호스트 Nginx만 접근할 수 있도록 EC2 루프백에만 바인딩한다.
      - "127.0.0.1:${SPRING_PORT:-8080}:8080"
    depends_on:
      postgres:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "wget -q -O - http://localhost:8080/actuator/health | grep -q UP"
        ]
      interval: 10s
      timeout: 5s
      retries: 15
      start_period: 30s
    networks:
      - safefam-network

  fastapi-ai:
    build:
      context: ../SafeFam_AI
      dockerfile: Dockerfile
    container_name: safefam-ai-server
    restart: unless-stopped
    environment:
      RABBITMQ_URL: ${RABBITMQ_URL:?RABBITMQ_URL is required}

      RABBITMQ_ANALYSIS_EXCHANGE: safefam.analysis
      RABBITMQ_ANALYSIS_REQUEST_QUEUE: safefam.analysis.requested.q
      RABBITMQ_ANALYSIS_REQUEST_ROUTING_KEY: analysis.requested.v1

      RABBITMQ_ANALYSIS_COMPLETED_ROUTING_KEY: analysis.completed.v1
      RABBITMQ_ANALYSIS_PARTIAL_ROUTING_KEY: analysis.partial.v1
      RABBITMQ_ANALYSIS_FAILED_ROUTING_KEY: analysis.failed.v1

      RABBITMQ_ANALYSIS_DLQ: safefam.analysis.requested.dlq
      RABBITMQ_ANALYSIS_DLQ_ROUTING_KEY: analysis.requested.dead.v1

      RABBITMQ_PREFETCH_COUNT: ${AI_RABBITMQ_PREFETCH_COUNT:-1}
      RABBITMQ_CONSUMER_ENABLED: "${AI_RABBITMQ_CONSUMER_ENABLED:-true}"
      RABBITMQ_PUBLISH_TIMEOUT_SECONDS: ${RABBITMQ_PUBLISH_TIMEOUT_SECONDS:-5}
      RABBITMQ_SHUTDOWN_TIMEOUT_SECONDS: ${RABBITMQ_SHUTDOWN_TIMEOUT_SECONDS:-30}
      RABBITMQ_REQUEUE_BACKOFF_SECONDS: ${RABBITMQ_REQUEUE_BACKOFF_SECONDS:-1}

      GEMINI_API_KEY: ${GEMINI_API_KEY:?GEMINI_API_KEY is required}
      VIRUSTOTAL_API_KEY: ${VIRUSTOTAL_API_KEY:-}
      GOOGLE_SAFE_BROWSING_API_KEY: ${GOOGLE_SAFE_BROWSING_API_KEY:-}
    command:
      [
        "uvicorn",
        "app.main:app",
        "--host",
        "0.0.0.0",
        "--port",
        "8000",
        "--root-path",
        "/ai"
      ]
    depends_on:
      rabbitmq:
        condition: service_healthy
    healthcheck:
      test:
        [
          "CMD",
          "python",
          "-c",
          "import urllib.request; urllib.request.urlopen('http://localhost:8000/', timeout=3)"
        ]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s
    networks:
      - safefam-network

networks:
  safefam-network:
    name: safefam-network
    driver: bridge