name: crypto_trading

services:
  backend:
    build: ./backend
    image: crypto_trading-backend
    container_name: crypto-trading-backend
    restart: unless-stopped
    mem_limit: ${CRYPTO_MEM_LIMIT:-1g}
    cpus: ${CRYPTO_CPUS:-2}
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    security_opt:
      - no-new-privileges:true
    # Reachable only on the internal network; the frontend nginx proxies to it.
    expose:
      - "8000"
    environment:
      - MODE=${CRYPTO_MODE:-paper}
      - EXCHANGE=${CRYPTO_EXCHANGE:-binance}
      - SYMBOL=${CRYPTO_SYMBOL:-BTC/USDT}
      - TIMEFRAME=${CRYPTO_TIMEFRAME:-1m}
      - POLL_INTERVAL=${CRYPTO_POLL_INTERVAL:-5}
      - STARTING_BALANCE=${CRYPTO_STARTING_BALANCE:-10000}
      - FEE_BPS=${CRYPTO_FEE_BPS:-10}
      - SLIPPAGE_BPS=${CRYPTO_SLIPPAGE_BPS:-5}
      - DATABASE_URL=sqlite:////data/trader.db
      - CORS_ORIGINS=${CRYPTO_CORS_ORIGINS:-*}
      - EXCHANGE_API_KEY=${CRYPTO_EXCHANGE_API_KEY:-}
      - EXCHANGE_API_SECRET=${CRYPTO_EXCHANGE_API_SECRET:-}
      - EXCHANGE_SANDBOX=${CRYPTO_EXCHANGE_SANDBOX:-false}
    volumes:
      # Persist the SQLite database across releases. Prefer an absolute host
      # path (CRYPTO_DATA_DIR / PERSISTENT_MOUNT); the repo-relative default
      # can be cleaned by runner maintenance.
      - ${CRYPTO_DATA_DIR:-./data}:/data
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/api/health', timeout=5).status==200 else 1)\""]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    networks:
      - internal

  frontend:
    build: ./frontend
    image: crypto_trading-frontend
    container_name: crypto-trading-frontend
    restart: unless-stopped
    mem_limit: ${CRYPTO_MEM_LIMIT:-1g}
    cpus: ${CRYPTO_CPUS:-2}
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"
    security_opt:
      - no-new-privileges:true
    depends_on:
      backend:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:80/ || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - internal
      - docker_default
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=docker_default"
      - "traefik.http.routers.crypto-trading.rule=Host(`crypto.${BASE_DOMAIN:-matitos.org}`)"
      - "traefik.http.routers.crypto-trading.entrypoints=websecure"
      - "traefik.http.routers.crypto-trading.tls.certresolver=myresolvercd"
      - "traefik.http.services.crypto-trading.loadbalancer.server.port=80"
      # Basic auth on the WebUI (htpasswd), required: the stack refuses to
      # start when CRYPTO_FRONTEND_AUTH_USERS is unset (no admin/admin
      # fallback). A per-source rate limit reduces credential brute-forcing.
      - "traefik.http.routers.crypto-trading.middlewares=crypto-trading-auth@docker,crypto-trading-sec@docker,crypto-trading-authlimit@docker"
      - "traefik.http.middlewares.crypto-trading-auth.basicauth.users=${CRYPTO_FRONTEND_AUTH_USERS:?CRYPTO_FRONTEND_AUTH_USERS is required (htpasswd string, e.g. htpasswd -nbB user pass)}"
      - "traefik.http.middlewares.crypto-trading-authlimit.ratelimit.average=${CRYPTO_AUTH_RATE_LIMIT_AVERAGE:-10}"
      - "traefik.http.middlewares.crypto-trading-authlimit.ratelimit.burst=${CRYPTO_AUTH_RATE_LIMIT_BURST:-5}"
      - "traefik.http.middlewares.crypto-trading-sec.headers.stsSeconds=31536000"
      - "traefik.http.middlewares.crypto-trading-sec.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.crypto-trading-sec.headers.forceSTSHeader=true"
      - "traefik.http.middlewares.crypto-trading-sec.headers.contentTypeNosniff=true"
      - "traefik.http.middlewares.crypto-trading-sec.headers.browserXssFilter=true"
      - "traefik.http.middlewares.crypto-trading-sec.headers.frameDeny=true"
      - "traefik.http.middlewares.crypto-trading-sec.headers.referrerPolicy=strict-origin-when-cross-origin"

networks:
  internal:
  docker_default:
    external: true