Deploy automation: 8-step pipeline with volume mounting, multi-container docker-compose

docker-compose.yml

@@ -1,27 +1,30 @@
 # =============================================================================
-# docker-compose.yml — CRM System v1.0 (local testing with PostgreSQL)
+# docker-compose.yml — LeoCRM Multi-Container Setup
 #
-# Use this file to run a full Postgres + crm-app stack locally, e.g. for
-# smoke-testing the Docker image or running the backend against a real
-# PostgreSQL instance before deploying to Coolify.
+# Full stack: PostgreSQL + Redis + App + Worker, all with persistent volumes.
 #
-# Production deploys in Coolify use COOLIFY_SETUP.md (single-container app +
-# a Coolify-managed Postgres database), NOT this file.
+# This file serves two purposes:
+# 1. Local development / testing: `docker compose up --build`
+# 2. Reference for the production multi-container architecture
 #
-# Usage:
+# Production deploys via Coolify use scripts/deploy.py which automates:
+#   - Coolify API build & deploy
+#   - Persistent volume mounting (patched into Coolify's generated compose)
+#   - Worker container startup
+#   - RLS policy enforcement
+#   - Health & domain verification
+#
+# Usage (local testing):
 #   cp .env.docker.example .env.docker
-#   $EDITOR .env.docker          # fill AUTH_SECRET, POSTGRES_PASSWORD, ...
+#   $EDITOR .env.docker          # fill SECRET_KEY, POSTGRES_PASSWORD, ...
 #   docker compose --env-file .env.docker up --build
-#   curl http://localhost:8000/health
+#   curl http://localhost:8000/api/v1/health
 # =============================================================================
 
 services:
-  # -------------------------------------------------------------------------
-  # PostgreSQL 16 (Alpine) — local Postgres for development / smoke tests.
-  # Coolify will provision its own managed Postgres database in production.
-  # -------------------------------------------------------------------------
+  # ── PostgreSQL 16 with pgvector ─────────────────────────────────────
   postgres:
-    image: postgres:16-alpine
+    image: pgvector/pgvector:pg16
     container_name: crm-postgres
     restart: unless-stopped
     environment:
@@ -32,7 +35,7 @@ services:
     volumes:
       - pgdata:/var/lib/postgresql/data
     ports:
-      - "5432:5432"   # local-only convenience; remove for CI / prod-like runs
+      - "5432:5432"   # local-only; remove for prod-like runs
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-crm_user} -d ${POSTGRES_DB:-crm_db}"]
       interval: 10s
@@ -42,10 +45,25 @@ services:
     networks:
       - crm-net
 
-  # -------------------------------------------------------------------------
-  # CRM App — built from the local Dockerfile.
-  # NOTE: no `image:` directive — we build from source on `docker compose up`.
-  # -------------------------------------------------------------------------
+  # ── Redis 7 (sessions, rate limiting, ARQ queue) ────────────────────
+  redis:
+    image: redis:7-alpine
+    container_name: crm-redis
+    restart: unless-stopped
+    command: redis-server --requirepass ${REDIS_PASSWORD:-changeme}
+    volumes:
+      - redisdata:/data
+    ports:
+      - "6379:6379"   # local-only; remove for prod-like runs
+    healthcheck:
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-changeme}", "ping"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - crm-net
+
+  # ── CRM API (FastAPI + Uvicorn) ─────────────────────────────────────
   crm-app:
     build:
       context: .
@@ -58,17 +76,23 @@ services:
       redis:
         condition: service_healthy
     environment:
-      # Use the internal docker-compose DNS name "postgres" (NOT localhost)
       DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
       REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD:-changeme}@redis:6379/0}
       SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
-      # Frontend served from same origin in production; allow local dev hosts too
       CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:8000,http://localhost:5173}
       ENVIRONMENT: ${ENVIRONMENT:-production}
       LOG_LEVEL: ${LOG_LEVEL:-INFO}
       SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-true}
       STORAGE_PATH: ${STORAGE_PATH:-/data/storage}
       BCRYPT_ROUNDS: ${BCRYPT_ROUNDS:-12}
+      # S3 Storage (optional — if STORAGE_BACKEND=s3)
+      STORAGE_BACKEND: ${STORAGE_BACKEND:-local}
+      S3_ENDPOINT: ${S3_ENDPOINT:-}
+      S3_BUCKET: ${S3_BUCKET:-}
+      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-}
+      S3_SECRET_KEY: ${S3_SECRET_KEY:-}
+      S3_REGION: ${S3_REGION:-us-east-1}
+      S3_SECURE: ${S3_SECURE:-true}
     ports:
       - "8000:8000"
     volumes:
@@ -82,61 +106,34 @@ services:
     networks:
       - crm-net
 
-  # -------------------------------------------------------------------------
-  # CRM Worker — ARQ background worker (same image, different entrypoint).
-  # Runs migrations? No — the API container handles migrations.
-  # Scale with `docker compose up --scale crm-worker=N`.
-  # Cron jobs use a Redis-based distributed lock so only one replica fires.
-  # -------------------------------------------------------------------------
+  # ── CRM Worker (ARQ background jobs, cron, outbox processor) ───────
   crm-worker:
     build:
       context: .
       dockerfile: Dockerfile
     container_name: crm-worker
     restart: unless-stopped
-    entrypoint: ["/app/worker.sh"]
     depends_on:
       postgres:
         condition: service_healthy
       redis:
         condition: service_healthy
+    entrypoint: ["/app/worker.sh"]
     environment:
       DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
       REDIS_URL: ${REDIS_URL:-redis://:${REDIS_PASSWORD:-changeme}@redis:6379/0}
       SECRET_KEY: ${SECRET_KEY:?SECRET_KEY is required (min 32 chars)}
       ENVIRONMENT: ${ENVIRONMENT:-production}
       LOG_LEVEL: ${LOG_LEVEL:-INFO}
+      SESSION_COOKIE_SECURE: ${SESSION_COOKIE_SECURE:-true}
       STORAGE_PATH: ${STORAGE_PATH:-/data/storage}
-      BCRYPT_ROUNDS: ${BCRYPT_ROUNDS:-12}
+      STORAGE_BACKEND: ${STORAGE_BACKEND:-local}
+      S3_ENDPOINT: ${S3_ENDPOINT:-}
+      S3_BUCKET: ${S3_BUCKET:-}
+      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-}
+      S3_SECRET_KEY: ${S3_SECRET_KEY:-}
     volumes:
       - storage:/data/storage
-    healthcheck:
-      # Check if the ARQ worker process is alive
-      test: ["CMD-SHELL", "pgrep -f \"arq app.core.worker.WorkerSettings\" || exit 1"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 15s
-    networks:
-      - crm-net
-
-  # -------------------------------------------------------------------------
-  # Redis 7 (Alpine) — sessions, rate limiting, ARQ queue.
-  # -------------------------------------------------------------------------
-  redis:
-    image: redis:7-alpine
-    container_name: crm-redis
-    restart: unless-stopped
-    command: redis-server --requirepass ${REDIS_PASSWORD:-changeme}
-    volumes:
-      - redisdata:/data
-    ports:
-      - "6379:6379"   # local-only convenience; remove for prod-like runs
-    healthcheck:
-      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD:-changeme}", "ping"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
     networks:
       - crm-net