# Telegram bot adapter — run on a separate server.
#
# The bot is deliberately stateless: it talks to Telegram and the central
# API over HTTP(S). It needs NO DB/MQ/S3 credentials, only BOT_TOKEN,
# BOT_SERVICE_TOKEN and API_URL. Keep this server lean and firewall-hardened.
#
# Update mode: polling by default; set BOT_UPDATE_MODE=webhook to serve
# updates at a secret-derived path (+ GET /healthz) on the webhook port.
# The port is published on loopback only — route it through your TLS edge
# (or a VPN interface via BOT_WEBHOOK_BIND_HOST), never the public internet.
# See docs/DEPLOY.md §14.4.
#
# Usage on the bot server:
#   cp .env.bot.example .env      # minimal bot-only environment
#   docker compose -f docker-compose.bot.yml up -d --build
#
# See docs/DEPLOY.md §14 for the full separate-server guide.

services:
  bot:
    build:
      context: .
      dockerfile: srv/bot/Dockerfile
    container_name: contract_check-bot
    restart: unless-stopped
    env_file:
      - path: .env
        required: false
    environment:
      ENV: ${ENV:-prod}
      LOG_LEVEL: ${LOG_LEVEL:-INFO}
      LOG_FORMAT: ${LOG_FORMAT:-json}
      BOT_TOKEN: ${BOT_TOKEN}
      API_URL: ${API_URL}
      BOT_SERVICE_TOKEN: ${BOT_SERVICE_TOKEN}
      # Update delivery mode + webhook settings (BOT_UPDATE_MODE=polling|webhook).
      BOT_UPDATE_MODE: ${BOT_UPDATE_MODE:-polling}
      BOT_WEBHOOK_PUBLIC_BASE_URL: ${BOT_WEBHOOK_PUBLIC_BASE_URL:-}
      BOT_WEBHOOK_SECRET_TOKEN: ${BOT_WEBHOOK_SECRET_TOKEN:-}
      # Local Redis for rate-limit state. Set to empty to use the in-memory
      # backend (fine for a single bot instance). The Redis container below is
      # not exposed outside the host; only the bot container can reach it.
      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
    ports:
      # Webhook/healthz server, only meaningful in webhook mode. Published on
      # loopback by default so only a local TLS edge / tunnel can reach it;
      # use BOT_WEBHOOK_BIND_HOST to point it at a private interface instead.
      - "${BOT_WEBHOOK_BIND_HOST:-127.0.0.1}:${BOT_WEBHOOK_PORT:-8080}:8080"
    depends_on:
      redis:
        condition: service_healthy
    healthcheck:
      # Webhook mode: probe the bot's own /healthz (the process under
      # supervision). Polling mode: keep probing the central API as before.
      test:
        - CMD-SHELL
        - >-
          if [ "$$BOT_UPDATE_MODE" = "webhook" ]; then
          python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=5)";
          else
          python -c "import urllib.request, os; urllib.request.urlopen(os.environ['API_URL'] + '/healthz', timeout=5)";
          fi
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

  redis:
    image: redis:8-alpine
    container_name: contract_check-redis
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "yes"]
    volumes:
      - redisdata:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

volumes:
  redisdata: