services:
  # Queue API Proxy - Routes queue.workolik.com (Traefik on host:443) to Kubernetes LoadBalancer (FastAPI)
  queue-api-proxy:
    image: nginx:alpine
    container_name: queue-api-proxy
    restart: unless-stopped
    ports:
      - "8202:8201"  # Internal port for Traefik to reach nginx
    volumes:
      - ./conf/nginx-queue-proxy.conf:/etc/nginx/nginx.conf:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      # Router for queue.workolik.com with CORS (proxying to K8s LoadBalancer)
      - "traefik.http.routers.queue-api.rule=Host(`queue.workolik.com`)"
      - "traefik.http.routers.queue-api.tls=true"
      - "traefik.http.routers.queue-api.tls.certresolver=letsencrypt"
      - "traefik.http.routers.queue-api.priority=100"
      - "traefik.http.services.queue-api.loadbalancer.server.port=8201"
      # Edge rate limit (per source IP, Traefik default). Predates this repo -
      # the running container (created 2026-05-30) had average=150/burst=50
      # baked in at creation time, undocumented here since labels aren't
      # re-read on an existing container. Raised to fit real bulk-order
      # traffic: NATS + the worker pool absorb bursts fine once a request
      # reaches the gateway, so this only needs to block actual flood-scale
      # abuse, not legitimate customers batching orders (2026-07-30).
      - "traefik.http.middlewares.queue-rl.ratelimit.average=300"
      - "traefik.http.middlewares.queue-rl.ratelimit.burst=400"
      - "traefik.http.routers.queue-api.middlewares=queue-rl"

  # Kubernetes dashboard proxy (kube.workolik.com ? K8s dashboard)
  k8s-dashboard-proxy:
    image: nginx:alpine
    container_name: k8s-dashboard-proxy
    restart: unless-stopped
    ports:
      - "8083:8083"
    volumes:
      - ./conf/nginx-k8s-dashboard.conf:/etc/nginx/nginx.conf:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.k8s-dashboard.rule=Host(`kube.workolik.com`)"
      - "traefik.http.routers.k8s-dashboard.tls=true"
      - "traefik.http.routers.k8s-dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.services.k8s-dashboard.loadbalancer.server.port=8083"
      - "traefik.docker.network=web"

  # Jupiter API Proxy (jupiter.nearle.app ? K8s Gateway)
  jupiter-proxy:
    image: nginx:alpine
    container_name: jupiter-proxy
    restart: unless-stopped
    ports:
      - "8203:8203"
    volumes:
      - ./conf/nginx-jupiter.conf:/etc/nginx/nginx.conf:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      - "traefik.http.routers.jupiter-api.rule=Host(`jupiter.nearle.app`)"
      - "traefik.http.routers.jupiter-api.tls=true"
      - "traefik.http.routers.jupiter-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.jupiter-api.loadbalancer.server.port=8203"

  # Fiesta API Proxy (fiesta.nearle.app ? K8s NodePort 30823)
  fiesta-proxy:
    image: nginx:alpine
    container_name: fiesta-proxy
    restart: unless-stopped
    ports:
      - "8204:8204"
    volumes:
      - ./conf/nginx-fiesta.conf:/etc/nginx/nginx.conf:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      - "traefik.http.routers.fiesta-api.rule=Host(`fiesta.nearle.app`)"
      - "traefik.http.routers.fiesta-api.tls=true"
      - "traefik.http.routers.fiesta-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.fiesta-api.loadbalancer.server.port=8204"

  # Atlantis API Proxy (atlantis.nearle.app ? K8s NodePort 30825)
  atlantis-proxy:
    image: nginx:alpine
    container_name: atlantis-proxy
    restart: unless-stopped
    ports:
      - "8205:8205"
    volumes:
      - ./conf/nginx-atlantis.conf:/etc/nginx/nginx.conf:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      - "traefik.http.routers.atlantis-api.rule=Host(`atlantis.nearle.app`)"
      - "traefik.http.routers.atlantis-api.tls=true"
      - "traefik.http.routers.atlantis-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.atlantis-api.loadbalancer.server.port=8205"

  # Doormile API Proxy (doormile.com -> K8s NodePort 30830)
  doormile-proxy:
    image: nginx:alpine
    container_name: doormile-proxy
    restart: unless-stopped
    ports:
      - "8206:8206"
    volumes:
      - ./conf/nginx-doormile.conf:/etc/nginx/nginx.conf:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - web
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=web"
      - "traefik.http.routers.doormile-api.rule=Host(`doormile.com`)"
      - "traefik.http.routers.doormile-api.tls=true"
      - "traefik.http.routers.doormile-api.tls.certresolver=letsencrypt"
      - "traefik.http.services.doormile-api.loadbalancer.server.port=8206"

networks:
  web:
    external: true