# Auto-generated by nself build
services:
  # Core services (postgres, hasura, auth, nginx)
  # ...

  # Custom Service 1: Payment API
  payment_api:
    build:
      context: ./services/payment_api
      dockerfile: Dockerfile
      args:
        NODE_ENV: production
    container_name: ${PROJECT_NAME}_payment_api
    restart: unless-stopped
    ports:
      - "8001:8001"
    environment:
      SERVICE_NAME: payment_api
      SERVICE_PORT: 8001
      NODE_ENV: production
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      HASURA_GRAPHQL_ENDPOINT: http://hasura:8080/v1/graphql
      HASURA_ADMIN_SECRET: ${HASURA_GRAPHQL_ADMIN_SECRET}
    depends_on:
      - postgres
      - redis
    networks:
      - nself-network
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8001/health"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.5'
          memory: 256M

  # Custom Service 2: Notification Worker
  notification_worker:
    build:
      context: ./services/notification_worker
      dockerfile: Dockerfile
    container_name: ${PROJECT_NAME}_notification_worker
    restart: unless-stopped
    environment:
      SERVICE_NAME: notification_worker
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD}
    depends_on:
      - redis
    networks:
      - nself-network
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M

# .nself/k8s/manifests/10-payment-api-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: payment-api
  namespace: myapp
  labels:
    app: payment-api
    component: custom-service
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: payment-api
  template:
    metadata:
      labels:
        app: payment-api
    spec:
      containers:
      - name: payment-api
        image: myregistry/payment-api:v1.0.0
        ports:
        - containerPort: 8001
          name: http
        env:
        - name: SERVICE_NAME
          value: "payment_api"
        - name: SERVICE_PORT
          value: "8001"
        - name: POSTGRES_HOST
          value: "postgres"
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: postgres-secret
              key: password
        resources:
          requests:
            cpu: "250m"
            memory: "256Mi"
          limits:
            cpu: "1000m"
            memory: "512Mi"
        livenessProbe:
          httpGet:
            path: /health
            port: 8001
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 3
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /health
            port: 8001
          initialDelaySeconds: 10
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 3
---
apiVersion: v1
kind: Service
metadata:
  name: payment-api
  namespace: myapp
spec:
  type: ClusterIP
  ports:
  - port: 8001
    targetPort: 8001
    protocol: TCP
    name: http
  selector:
    app: payment-api
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: payment-api-hpa
  namespace: myapp
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: payment-api
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80

# .github/workflows/deploy-custom-services.yml
name: Deploy Custom Services

on:
  push:
    branches: [main]
    paths:
      - 'services/**'
      - '.environments/prod/.env'

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3

      - name: Install nself
        run: |
          curl -fsSL https://install.nself.org | bash
          echo "$HOME/.nself/bin" >> $GITHUB_PATH

      - name: Setup SSH Key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key

      - name: Setup Production Environment
        run: |
          mkdir -p .environments/prod
          echo "${{ secrets.PROD_ENV }}" > .environments/prod/.env
          echo "${{ secrets.PROD_SECRETS }}" > .environments/prod/.env.secrets
          chmod 600 .environments/prod/.env.secrets

      - name: Build Custom Services
        run: nself build

      - name: Run Tests
        run: |
          # Test each custom service
          cd services/payment_api && npm test
          cd ../notification_worker && npm test

      - name: Security Scan
        run: |
          docker scan myapp_payment_api:latest || true

      - name: Deploy to Production
        run: |
          nself deploy prod --backend-only

      - name: Health Checks
        run: |
          nself deploy health --env prod

      - name: Notify on Failure
        if: failure()
        run: |
          curl -X POST ${{ secrets.SLACK_WEBHOOK }} \
            -d '{"text":"Custom services deployment failed!"}'

# .gitlab-ci.yml
stages:
  - build
  - test
  - deploy

variables:
  DOCKER_HOST: tcp://docker:2375
  DOCKER_DRIVER: overlay2

build:
  stage: build
  image: docker:latest
  services:
    - docker:dind
  script:
    - docker build -t $CI_REGISTRY_IMAGE/payment-api:$CI_COMMIT_SHORT_SHA services/payment_api
    - docker build -t $CI_REGISTRY_IMAGE/notification-worker:$CI_COMMIT_SHORT_SHA services/notification_worker
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker push $CI_REGISTRY_IMAGE/payment-api:$CI_COMMIT_SHORT_SHA
    - docker push $CI_REGISTRY_IMAGE/notification-worker:$CI_COMMIT_SHORT_SHA

test:
  stage: test
  image: node:18
  script:
    - cd services/payment_api && npm ci && npm test
    - cd ../notification_worker && npm ci && npm test

deploy:prod:
  stage: deploy
  image: alpine:latest
  only:
    - main
  before_script:
    - apk add --no-cache curl bash openssh-client rsync
    - curl -fsSL https://install.nself.org | bash
    - eval $(ssh-agent -s)
    - echo "$DEPLOY_SSH_KEY" | tr -d '\r' | ssh-add -
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
  script:
    - export PATH="$HOME/.nself/bin:$PATH"
    - nself deploy prod
  environment:
    name: production
    url: https://api.example.com

# docker-compose.yml (manual edit or custom config)
services:
  payment_api:
    # ... existing config
    deploy:
      mode: replicated
      replicas: 3
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.5'
          memory: 256M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3

# docker-compose.yml
services:
  payment_api:
    networks:
      - nself-network
    # Don't expose to host unless necessary
    # ports:
    #   - "8001:8001"  # Remove this for internal-only services