Installation & Configuration

version: '3.8'
name: testhide

services:
  # ==========================================
  # FRONTEND (Nginx + Angular)
  # ==========================================
  frontend:
    container_name: testhide_frontend
    image: thuesdays/testhide-frontend:latest
    restart: always
    ports:
      - "80:80"
      - "443:443"
      - "7771:7771"
    env_file:
      - .env
    environment:
      - CERT_FILE=${CERT_FILE}
      - CERT_KEY=${CERT_KEY}
    volumes:
      - ./ssl:/etc/ssl:ro
      - ./nginx/api.conf:/etc/nginx/conf.d/api.conf:ro
      - testhide_static_data:/usr/share/nginx/html/static:ro
    depends_on:
      - backend
      - ai-api
    networks:
      - testhide-net
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 256m

  # ==========================================
  # BACKEND (Python API)
  # ==========================================
  backend:
    # Note: container_name removed to allow replicas
    # Note: No port exposed - accessed via nginx proxy
    image: thuesdays/testhide-backend:latest
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - LOAD_AI_MODELS=false
      - RUN_AI_WORKER=false
      - GUNICORN_WORKERS=2
      - COMPOSE_PROJECT_NAME=testhide
    volumes:
      - testhide_static_data:/app/static
      - ./releases:/app/releases
      - ./monitoring_scripts:/app/monitoring_scripts
      - ./gunicorn.conf.py:/app/gunicorn.conf.py:ro
      - ./ssl:/etc/ssl:ro
      - ./sandbox_data:/app/sandbox_data
      # Docker access for container restart from the API
      - /var/run/docker.sock:/var/run/docker.sock
      - ./docker-compose.prod.yaml:/app/docker-compose.yaml:ro
    depends_on:
      mongo:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - testhide-net
    healthcheck:
      disable: true
    mem_limit: 2.5g
    memswap_limit: 2.5g
    deploy:
      replicas: 2
      resources:
        limits:
          cpus: "2.0"
          memory: 2.5g
        reservations:
          cpus: "0.5"
          memory: 1g

  # ==========================================
  # AI API (HTTP only — serves /api/v3/ai/ requests)
  # ==========================================
  ai-api:
    container_name: testhide_ai_api
    image: thuesdays/testhide-backend:latest
    restart: unless-stopped
    # Note: No external port - accessed via nginx proxy on 7771
    env_file:
      - .env
    environment:
      - LOAD_AI_MODELS=true
      - RUN_AI_WORKER=false
      - GUNICORN_WORKERS=2
    volumes:
      - testhide_static_data:/app/static
      - ./sandbox_data:/app/sandbox_data
      - ./releases:/app/releases
      - ./monitoring_scripts:/app/monitoring_scripts
      - ./gunicorn.conf.py:/app/gunicorn.conf.py:ro
      - ./ssl:/etc/ssl:ro
    depends_on:
      mongo:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      - testhide-net
    healthcheck:
      disable: true
    mem_limit: 5g
    memswap_limit: 5g
    deploy:
      replicas: 1
      resources:
        limits:
          cpus: "2.0"
          memory: 5g
        reservations:
          cpus: "0.5"
          memory: 3g

  # ==========================================
  # AI WORKER (Background: training, vectorization, diagnostics)
  # ==========================================
  ai-worker:
    container_name: testhide_ai_worker
    image: thuesdays/testhide-backend:latest
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - LOAD_AI_MODELS=true
      - RUN_AI_WORKER=true
      - GUNICORN_WORKERS=1
      # OOM prevention: must be BELOW mem_limit
      - AI_MEMORY_LIMIT_MB=7500
      # Reduce parallelism to lower peak memory
      - AI_ASSIST_INFER_WORKERS=2
      - AI_ASSIST_IO_WORKERS=3
      - AI_ASSIST_LLM_WORKERS=1
    volumes:
      - testhide_static_data:/app/static
      - ./sandbox_data:/app/sandbox_data
      - ./releases:/app/releases
      - ./monitoring_scripts:/app/monitoring_scripts
      - ./gunicorn.conf.py:/app/gunicorn.conf.py:ro
      - ./ssl:/etc/ssl:ro
    depends_on:
      mongo:
        condition: service_healthy
      redis:
        condition: service_healthy
    networks:
      testhide-net:
        aliases:
          - ai-worker
    healthcheck:
      disable: true
    mem_limit: 10g
    memswap_limit: 10g
    deploy:
      replicas: 1
      resources:
        limits:
          cpus: "2.0"
          memory: 10g
        reservations:
          cpus: "0.5"
          memory: 5g

  # ==========================================
  # DATABASES
  # ==========================================
  mongo:
    container_name: testhide_mongo
    image: 'mongo:8.2.3'
    restart: always
    command: [ "mongod", "--auth", "--wiredTigerCacheSizeGB", "2" ]
    environment:
      - MONGO_INITDB_ROOT_USERNAME=${MONGO_USER}
      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_PASS}
    ports:
      - "27017:27017"
    volumes:
      - ${MONGO_DATA_PATH}:/data/db
    networks:
      - testhide-net
    healthcheck:
      test: [ "CMD", "mongosh", "--norc", "--quiet", "-u", "${MONGO_USER}", "-p", "${MONGO_PASS}", "--authenticationDatabase", "admin", "--eval", "db.adminCommand('ping')" ]
      interval: 30s
      timeout: 5s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: "1.5"
          memory: 3g
        reservations:
          cpus: "0.5"
          memory: 1.5g

  redis:
    container_name: testhide_redis
    image: redis:7-alpine
    restart: always
    command: [ "redis-server", "--maxmemory", "512mb", "--maxmemory-policy", "allkeys-lru", "--appendonly", "no", "--requirepass", "${REDIS_PASSWORD}" ]
    networks:
      - testhide-net
    healthcheck:
      test: [ "CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping" ]
      interval: 10s
      timeout: 3s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 768m

# ==========================================
# VOLUMES & NETWORKS
# ==========================================
volumes:
  testhide_static_data:
    name: testhide_static_data

networks:
  testhide-net:
    name: testhide-net