docker-compose.yml

services:
  traefik:
    image: traefik:v3.6
    container_name: sysndd_traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    command:
      # Enable API for healthcheck CLI but disable dashboard (security)
      # Internal API uses 'traefik' entrypoint, our routes use 'web' - no conflict
      - "--api=true"
      - "--api.insecure=true"
      - "--api.dashboard=false"
      # Docker provider
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=sysndd_proxy"
      # HTTP entrypoint
      - "--entryPoints.web.address=:80"
      # RFC 3986 encoded characters - allow all (backend handles decoding)
      # See: https://doc.traefik.io/traefik/v3.6/security/request-path/
      - "--entryPoints.web.http.encodedCharacters.allowEncodedSlash=true"
      - "--entryPoints.web.http.encodedCharacters.allowEncodedBackSlash=true"
      - "--entryPoints.web.http.encodedCharacters.allowEncodedPercent=true"
      # Enable ping for health checks (on API port for traefik healthcheck CLI)
      - "--ping=true"
      # Minimal logging in production
      - "--log.level=WARN"
    ports:
      - "80:80"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.25'

  mysql:
    image: mysql:8.4.9
    container_name: sysndd_mysql
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    command:
      - --authentication-policy=caching_sha2_password
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
    environment:
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
    volumes:
      - mysql_data:/var/lib/mysql
      - mysql_backup:/backup
    networks:
      - backend
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-u", "${MYSQL_USER}", "-p${MYSQL_PASSWORD}"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    deploy:
      resources:
        limits:
          memory: 1024M
          cpus: '1.0'

  mysql-cron-backup:
    image: fradelg/mysql-cron-backup
    container_name: sysndd_mysql_backup
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      - mysql
    volumes:
      - mysql_backup:/backup
    environment:
      MYSQL_HOST: mysql
      MYSQL_USER: root
      MYSQL_PASS: ${MYSQL_ROOT_PASSWORD}
      MAX_BACKUPS: 60
      INIT_BACKUP: 1
      # Every day at 03:00
      CRON_TIME: 0 3 * * *
      # Make it small
      GZIP_LEVEL: 9
    networks:
      - backend
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'

  api:
    build:
      context: ./api/
      args:
        # UID/GID for non-root user - matches most Linux hosts (uid 1000)
        # Override with HOST_UID/HOST_GID env vars for different host users
        UID: ${HOST_UID:-1000}
        GID: ${HOST_GID:-1000}
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"
    # Run from /app where packages are installed, with selective mounts for dev
    volumes:
      - ./api/endpoints:/app/endpoints
      - ./api/functions:/app/functions
      - ./api/core:/app/core
      - ./api/services:/app/services
      - ./api/bootstrap:/app/bootstrap
      - ./api/config:/app/config
      - ./api/data:/app/data
      - ./api/results:/app/results
      - ./db/migrations:/app/db/migrations:ro
      - api_cache:/app/cache
      - mysql_backup:/backup:rw
      - ./api/config.yml:/app/config.yml
      - ./api/version_spec.json:/app/version_spec.json
      - ./api/start_sysndd_api.R:/app/start_sysndd_api.R
    environment:
      ENVIRONMENT: production
      PASSWORD: ${PASSWORD}
      SMTP_PASSWORD: ${SMTP_PASSWORD}
      DB_POOL_SIZE: ${DB_POOL_SIZE:-5}
      MIRAI_WORKERS: ${MIRAI_WORKERS:-2}
      GEMINI_API_KEY: ${GEMINI_API_KEY:-}
      # CORS configuration: comma-separated list of allowed origins
      # Critical for Firefox compatibility (issue #143)
      CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-}
      CACHE_VERSION: ${CACHE_VERSION:-2}
      # OMIM download key for genemap2.txt (required for ontology/comparisons)
      OMIM_DOWNLOAD_KEY: ${OMIM_DOWNLOAD_KEY}
    networks:
      - proxy
      - backend
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:7777/api/health/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    deploy:
      resources:
        limits:
          memory: 4608M
          cpus: '2.0'
    develop:
      watch:
        - action: sync
          path: ./api/endpoints
          target: /app/endpoints
        - action: sync
          path: ./api/functions
          target: /app/functions
        - action: sync
          path: ./api/core
          target: /app/core
        - action: sync
          path: ./api/services
          target: /app/services
        - action: sync
          path: ./api/bootstrap
          target: /app/bootstrap
        - action: rebuild
          path: ./api/renv.lock
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`sysndd.dbmr.unibe.ch`) && PathPrefix(`/api`)"
      - "traefik.http.routers.api.entrypoints=web"
      - "traefik.http.routers.api.priority=100"
      - "traefik.http.services.api.loadbalancer.server.port=7777"
      # Sticky sessions for job state consistency across scaled API containers
      - "traefik.http.services.api.loadbalancer.sticky.cookie=true"
      - "traefik.http.services.api.loadbalancer.sticky.cookie.name=sysndd_api_sticky"
      - "traefik.http.services.api.loadbalancer.sticky.cookie.httponly=true"
      - "traefik.http.services.api.loadbalancer.sticky.cookie.samesite=lax"

  app:
    build: ./app/
    container_name: sysndd_app
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - proxy
    healthcheck:
      # Use 127.0.0.1 instead of localhost to avoid IPv6 resolution issues in Alpine
      test: ["CMD", "wget", "--spider", "--tries=1", "--no-verbose", "http://127.0.0.1:8080/"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    deploy:
      resources:
        limits:
          memory: 256M
          cpus: '0.5'
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`sysndd.dbmr.unibe.ch`) && PathPrefix(`/`)"
      - "traefik.http.routers.app.entrypoints=web"
      - "traefik.http.services.app.loadbalancer.server.port=8080"
      - "traefik.http.routers.app.priority=1"

networks:
  proxy:
    name: sysndd_proxy
    driver: bridge
  backend:
    name: sysndd_backend
    driver: bridge
    internal: true

volumes:
  mysql_data:
    name: sysndd_mysql_data
  mysql_backup:
    name: sysndd_mysql_backup
  api_cache:
    name: sysndd_api_cache