# Unraid production overlay. Compose with the base topology:
#   docker compose -f compose.yaml -f compose.production.yaml up -d
#
# Everything already parameterized in compose.yaml (RAGCORE_STATE_ROOT,
# RAGCORE_HOST_PORT, POSTGRES_*, QDRANT_API_KEY) is configured via .env --
# copy .env.example to .env, set RAGCORE_STATE_ROOT to a direct SSD/NVMe
# pool path (e.g. /mnt/<pool>/appdata/ragcore, never /mnt/pool/...) and
# generate real secrets. See docs/09_OPERATIONS/UNRAID_DEPLOYMENT.md.
#
# This overlay only adds what genuinely differs for production: requiring
# real secrets (no silent fallback to the insecure .env.example defaults
# base compose.yaml also loads for local dev convenience), forcing
# production mode itself, and resource limits. Healthchecks, non-root/
# no-new-privileges, restart policies and the internal-only backend network
# (only `app`/`mcp` are ever published) are already unconditional in
# compose.yaml; nothing here changes them.
#
# RAGCORE_ENV=production is set here explicitly (not left to .env) on
# purpose: `environment:` always wins over `env_file`-sourced values
# regardless of file order, so an operator who copies .env.example to .env
# without touching RAGCORE_ENV (it still says `development` there) cannot
# accidentally deploy this overlay in development mode -- Settings'
# own fail-closed validation (secrets, storage paths, ...) only ever runs
# when env is actually "production".
services:
  app:
    environment:
      RAGCORE_ENV: production
      RAGCORE_TRUSTED_PROXY_IPS: "${RAGCORE_TRUSTED_PROXY_IPS:?set the dedicated proxy IP or CIDR}"
    env_file:
      - path: .env
        required: true
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: 2g
    networks:
      edge:
      backend:
      proxy:
        aliases: [ragcore-app]

  worker:
    environment:
      RAGCORE_ENV: production
    env_file:
      - path: .env
        required: true
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: 2g

  mcp:
    environment:
      RAGCORE_ENV: production
    env_file:
      - path: .env
        required: true
    deploy:
      resources:
        limits:
          cpus: "1"
          memory: 1g

  postgres:
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: 2g

  qdrant:
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: 4g

networks:
  proxy:
    name: "${RAGCORE_PROXY_NETWORK:-ragcore-proxy}"
    external: true