version: "3.8"

services:
  tmi:
    image: tmi-server:latest
    ports:
      - "8080:8080"
    environment:
      - TMI_DATABASE_URL=postgres://tmi_user:${POSTGRES_PASSWORD}@postgres:5432/tmi?sslmode=disable
      - TMI_REDIS_HOST=redis
      - TMI_REDIS_PORT=6379
      - TMI_REDIS_PASSWORD=${REDIS_PASSWORD}
      - TMI_JWT_SECRET=${JWT_SECRET}
      - TMI_OAUTH_CALLBACK_URL=https://tmi.example.com/oauth2/callback
      - TMI_CORS_ALLOWED_ORIGINS=https://tmi.example.com
      - TMI_LOG_LEVEL=info
      - TMI_LOG_IS_DEV=false
      # OAuth providers use non-TMI-prefixed env vars with dynamic discovery
      - OAUTH_PROVIDERS_GOOGLE_ENABLED=true
      - OAUTH_PROVIDERS_GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
      - OAUTH_PROVIDERS_GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
      - OAUTH_PROVIDERS_GOOGLE_NAME=Google
      - OAUTH_PROVIDERS_GOOGLE_AUTHORIZATION_URL=https://accounts.google.com/o/oauth2/auth
      - OAUTH_PROVIDERS_GOOGLE_TOKEN_URL=https://oauth2.googleapis.com/token
      - OAUTH_PROVIDERS_GOOGLE_USERINFO_URL=https://www.googleapis.com/oauth2/v3/userinfo
      - OAUTH_PROVIDERS_GOOGLE_SCOPES=openid,profile,email
    depends_on:
      - postgres
      - redis
    restart: unless-stopped

  postgres:
    image: postgres:15
    environment:
      - POSTGRES_USER=tmi_user
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=tmi
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
    ports:
      - "5432:5432"

  redis:
    image: redis:7-alpine
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    restart: unless-stopped
    ports:
      - "6379:6379"

volumes:
  postgres_data:
  redis_data:

# namespace.yml
apiVersion: v1
kind: Namespace
metadata:
  name: tmi-platform

# configmap.yml
apiVersion: v1
kind: ConfigMap
metadata:
  name: tmi-config
  namespace: tmi-platform
data:
  TMI_REDIS_HOST: "redis"
  TMI_REDIS_PORT: "6379"
  TMI_OAUTH_CALLBACK_URL: "https://tmi.example.com/oauth2/callback"
  TMI_CORS_ALLOWED_ORIGINS: "https://tmi.example.com"
  TMI_LOG_LEVEL: "info"
  TMI_LOG_IS_DEV: "false"

# secrets.yml
apiVersion: v1
kind: Secret
metadata:
  name: tmi-secrets
  namespace: tmi-platform
type: Opaque
data:
  TMI_DATABASE_URL: <base64-encoded-database-url>
  TMI_JWT_SECRET: <base64-encoded-jwt-secret>
  TMI_REDIS_PASSWORD: <base64-encoded-redis-password>
  OAUTH_PROVIDERS_GOOGLE_ENABLED: <base64-encoded: dHJ1ZQ==>
  OAUTH_PROVIDERS_GOOGLE_CLIENT_ID: <base64-encoded-client-id>
  OAUTH_PROVIDERS_GOOGLE_CLIENT_SECRET: <base64-encoded-client-secret>

# deployment.yml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tmi-server
  namespace: tmi-platform
spec:
  replicas: 3
  selector:
    matchLabels:
      app: tmi-server
  template:
    metadata:
      labels:
        app: tmi-server
    spec:
      containers:
        - name: tmi-server
          image: tmi-server:latest
          ports:
            - containerPort: 8080
          envFrom:
            - configMapRef:
                name: tmi-config
            - secretRef:
                name: tmi-secrets
          livenessProbe:
            httpGet:
              path: /
              port: 8080
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
          resources:
            requests:
              memory: "256Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"

# service.yml
apiVersion: v1
kind: Service
metadata:
  name: tmi-service
  namespace: tmi-platform
spec:
  selector:
    app: tmi-server
  ports:
    - port: 80
      targetPort: 8080
  type: ClusterIP

# ingress.yml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tmi-ingress
  namespace: tmi-platform
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
    nginx.ingress.kubernetes.io/websocket-services: "tmi-service"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.tmi.example.com
      secretName: tmi-tls
  rules:
    - host: api.tmi.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: tmi-service
                port:
                  number: 80

# config-production.yml
server:
  port: "8080"
  interface: "0.0.0.0"
  tls_enabled: true
  tls_cert_file: "/etc/tmi/certs/server.crt"
  tls_key_file: "/etc/tmi/certs/server.key"
  tls_subject_name: "tmi.yourdomain.com"
  http_to_https_redirect: true

database:
  url: ""  # Set via TMI_DATABASE_URL environment variable; never store passwords in config files
  connection_pool:
    max_open_conns: 25
    max_idle_conns: 25
    conn_max_lifetime: 300
    conn_max_idle_time: 300
  redis:
    host: "redis.example.com"
    port: "6379"
    password: ""  # Set via TMI_REDIS_PASSWORD
    db: 0

auth:
  jwt:
    secret: ""  # Set via TMI_JWT_SECRET
    expiration_seconds: 3600
    signing_method: "HS256"
  oauth:
    callback_url: "https://tmi.example.com/oauth2/callback"
    providers:
      google:
        id: "google"
        name: "Google"
        enabled: true
        icon: "fa-brands fa-google"
        client_id: ""  # Set via env var
        client_secret: ""  # Set via env var
        authorization_url: "https://accounts.google.com/o/oauth2/auth"
        token_url: "https://oauth2.googleapis.com/token"
        userinfo:
          - url: "https://www.googleapis.com/oauth2/v3/userinfo"
            claims: {}
        issuer: "https://accounts.google.com"
        scopes:
          - openid
          - profile
          - email

websocket:
  inactivity_timeout_seconds: 600

logging:
  level: "warn"
  is_dev: false
  log_dir: "/var/log/tmi"
  max_age_days: 30
  max_size_mb: 500

operator:
  name: "TMI Production Instance"
  contact: "[email protected]"

# In config YAML
database:
  connection_pool:
    max_open_conns: 25
    max_idle_conns: 10
    conn_max_lifetime: 300
    conn_max_idle_time: 60

server:
  read_timeout: 10s    # Default: 5s
  write_timeout: 30s   # Default: 10s
  idle_timeout: 2m0s   # Default: 60s