# ===========================================================================
# Example Docker Compose file
# ===========================================================================
#
# Purpose:
# --------
#
# This file is an example Docker Compose configuration for self hosting
# Sure on your local machine or on a cloud VPS.
#
# The configuration below is a "standard" setup that works out of the box,
# but if you're running this outside of a local network, it is recommended
# to set the environment variables for extra security.
#
# Setup:
# ------
#
# To run this, you should read the setup guide:
#
# https://github.com/we-promise/sure/blob/main/docs/hosting/docker.md
#
# Troubleshooting:
# ----------------
#
# Problems? Swing by our Discord or open a Discussion here:
#
# https://github.com/we-promise/sure/discussions/categories/general
#
# IPv6 Note (Yahoo Finance Sync, others?):
# ----------------------------------------
# If you encounter "Failed to open TCP connection" errors to hosts like
# fc.yahoo.com in your environment, the issue may be that DNS resolves
# to an IPv6 address first. Since IPv6 may not be configured in the container,
# the connection hangs. To work around this, you can hardcode the IPv4
# addresses in your container's /etc/hosts or set custom DNS:
#
#   extra_hosts:
#     - "fc.yahoo.com:173.223.12.81"
#     - "query1.finance.yahoo.com:98.136.48.169"
#     - "query2.finance.yahoo.com:98.136.48.169"
#
# Or use explicit DNS servers that prefer IPv4 (already configured below).
#

x-db-env: &db_env
  POSTGRES_USER: ${POSTGRES_USER:-sure_user}
  POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-sure_password}
  POSTGRES_DB: ${POSTGRES_DB:-sure_production}

x-rails-env: &rails_env
  <<: *db_env
  SECRET_KEY_BASE: ${SECRET_KEY_BASE:-a7523c3d0ae56415046ad8abae168d71074a79534a7062258f8d1d51ac2f76d3c3bc86d86b6b0b307df30d9a6a90a2066a3fa9e67c5e6f374dbd7dd4e0778e13}
  SELF_HOSTED: "true"
  RAILS_FORCE_SSL: "false"
  RAILS_ASSUME_SSL: "false"
  DB_HOST: db
  DB_PORT: 5432
  REDIS_URL: redis://redis:6379/1
  # NOTE: enabling OpenAI will incur costs when you use AI-related features in the app (chat, rules).  Make sure you have set appropriate spend limits on your account before adding this.
  OPENAI_ACCESS_TOKEN: ${OPENAI_ACCESS_TOKEN}
  OPENAI_MODEL: ${OPENAI_MODEL:-}
  OPENAI_URI_BASE: ${OPENAI_URI_BASE:-}
  LLM_CONTEXT_WINDOW: ${LLM_CONTEXT_WINDOW:-}
  OPENAI_REQUEST_TIMEOUT: ${OPENAI_REQUEST_TIMEOUT:-60}
  # Health-check probes (System Health → AI Status → "Run checks") bound each
  # probe call. Distinct from OPENAI_REQUEST_TIMEOUT, which bounds real LLM
  # calls the app makes; the probe default is 5s. AI_HEALTH_PROBE_CACHE_TTL
  # controls how long probe results are cached (default 60s).
  AI_HEALTH_PROBE_TIMEOUT: ${AI_HEALTH_PROBE_TIMEOUT:-}
  AI_HEALTH_PROBE_CACHE_TTL: ${AI_HEALTH_PROBE_CACHE_TTL:-}
  # Seconds the chat waits for an assistant response before showing a "no response"
  # error. This covers the whole turn, so its worst case is a sum:
  #   (1 + ASSISTANT_MAX_TOOL_CALL_ITERATIONS) * OPENAI_REQUEST_TIMEOUT
  #     + tool execution + queue wait
  # 90 is sized for typical cloud latency, not that bound — raise it (or lower the
  # tool-call cap) once per-call latency approaches OPENAI_REQUEST_TIMEOUT, which
  # is what happens with a local model. See compose.example.ai.yml.
  AI_RESPONSE_TIMEOUT: ${AI_RESPONSE_TIMEOUT:-90}
  ASSISTANT_MAX_TOOL_CALL_ITERATIONS: ${ASSISTANT_MAX_TOOL_CALL_ITERATIONS:-}

services:
  web:
    image: ghcr.io/we-promise/sure:stable
    volumes:
      - app-storage:/rails/storage
    ports:
      - ${PORT:-3000}:3000
      # To also publish on IPv6 (dual-stack), uncomment the line below AND
      # set BINDING=:: in the environment block. See docs/hosting/docker.md
      # "Binding to IPv6" for details.
      # - "[::]:${PORT:-3000}:3000"
    restart: unless-stopped
    environment:
      <<: *rails_env
      # BINDING: "::"  # Uncomment for IPv6 dual-stack inside the container
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    dns:
      - 8.8.8.8
      - 1.1.1.1
    networks:
      - sure_net

  worker:
    image: ghcr.io/we-promise/sure:stable
    command: bundle exec sidekiq
    volumes:
      - app-storage:/rails/storage
    restart: unless-stopped
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    dns:
      - 8.8.8.8
      - 1.1.1.1
    environment:
      <<: *rails_env
    networks:
      - sure_net

  db:
    image: postgres:16
    restart: unless-stopped
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      <<: *db_env
    healthcheck:
      test: [ "CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB" ]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - sure_net

  backup:
    profiles:
      - backup
    image: alpine:3.20
    restart: unless-stopped
    volumes:
      - ./bin/db-backup.sh:/usr/local/bin/db-backup.sh:ro
    environment:
      - POSTGRES_HOST=db
      - POSTGRES_DB
      - POSTGRES_USER
      - POSTGRES_PASSWORD # pipelock:ignore
      - BACKUP_SCHEDULE
      - BACKUP_OVERWRITE
      - BACKUP_KEEP_DAYS
      - BACKUP_DESTINATION
      - INSTANCE_ID
      # Rclone Provider Config
      # By default we map the S3 variables. If you use a different provider (e.g., gdrive), 
      # replace these with the equivalent variables you added to your .env file.
      - RCLONE_CONFIG_S3_TYPE
      - RCLONE_CONFIG_S3_PROVIDER
      - RCLONE_CONFIG_S3_ACCESS_KEY_ID
      - RCLONE_CONFIG_S3_SECRET_ACCESS_KEY
      - RCLONE_CONFIG_S3_ENDPOINT
    command: >
      sh -c "apk add --no-cache postgresql16-client~=16 rclone~=1.66 gzip~=1 &&
             echo \"$${BACKUP_SCHEDULE:-0 2 * * *} /usr/local/bin/db-backup.sh\" > /etc/crontabs/root &&
             crond -f -d 8"
    depends_on:
      - db
    networks:
      - sure_net

  redis:
    image: redis:latest
    restart: unless-stopped
    volumes:
      - redis-data:/data
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - sure_net

volumes:
  app-storage:
  postgres-data:
  redis-data:

networks:
  sure_net:
    driver: bridge