docker-compose.prod.yml

# ═══════════════════════════════════════════════════════════════════════
#  Project Velure — Production Compose
#
#  Differences from docker-compose.yml (dev):
#    • All credentials sourced from required env vars (no defaults).
#      `docker compose --env-file .env.prod -f docker-compose.prod.yml up`
#    • Postgres + Redis are NOT exposed on the host network.
#    • Per-service log rotation caps (json-file, 50 MB × 5).
#    • Read-only root filesystems where possible + tmpfs for /tmp.
#    • Resource limits (mem + cpus) so a runaway model can't OOM the host.
#    • TimescaleDB image (postgres:16 + timescale/timescaledb extension).
#    • Backend `restart: always`, longer healthcheck start_period.
#    • Internal network is not externally addressable.
# ═══════════════════════════════════════════════════════════════════════

x-logging: &default-logging
  driver: json-file
  options:
    max-size: "50m"
    max-file: "5"

services:
  redis:
    image: redis:7-alpine
    restart: always
    command: >
      redis-server
      --maxmemory 256mb
      --maxmemory-policy allkeys-lru
      --appendonly yes
      --requirepass ${REDIS_PASSWORD:?REDIS_PASSWORD is required}
    volumes:
      - redis_data:/data
    networks:
      - velure_internal
    healthcheck:
      test: ["CMD-SHELL", "redis-cli -a $$REDIS_PASSWORD ping | grep -q PONG"]
      interval: 10s
      timeout: 3s
      retries: 5
    deploy:
      resources:
        limits:
          memory: 384M
          cpus: "0.50"
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp
    logging: *default-logging

  postgres:
    # TimescaleDB extends Postgres 16 — required for hypertables / continuous aggregates
    image: timescale/timescaledb:latest-pg16
    restart: always
    environment:
      POSTGRES_DB: ${POSTGRES_DB:?POSTGRES_DB is required}
      POSTGRES_USER: ${POSTGRES_USER:?POSTGRES_USER is required}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
      # Tuning hints — Timescale recommends these
      TIMESCALEDB_TELEMETRY: "off"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./backend/db/schema.sql:/docker-entrypoint-initdb.d/01-schema.sql:ro
      - ./backend/db/seed.sql:/docker-entrypoint-initdb.d/02-seed.sql:ro
      - ./backend/db/schema_timescale.sql:/docker-entrypoint-initdb.d/03-timescale.sql:ro
      - ./backend/db/migrations/04_audit.sql:/docker-entrypoint-initdb.d/04-audit.sql:ro
    networks:
      - velure_internal
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 30s
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: "1.00"
    security_opt:
      - no-new-privileges:true
    logging: *default-logging

  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    restart: always
    expose:
      - "8000"
    ports:
      # Bind to loopback only — front a TLS-terminating reverse proxy
      # (nginx/caddy/traefik) in front of this in real deployment.
      - "127.0.0.1:8000:8000"
    env_file:
      - .env.prod
    environment:
      REDIS_HOST: redis
      REDIS_PORT: "6379"
      REDIS_PASSWORD: ${REDIS_PASSWORD:?}
      POSTGRES_HOST: postgres
      POSTGRES_PORT: "5432"
      POSTGRES_DB: ${POSTGRES_DB:?}
      POSTGRES_USER: ${POSTGRES_USER:?}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?}
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
      USE_TIMESCALE: "1"
      VELURE_API_KEY: ${VELURE_API_KEY:?VELURE_API_KEY is required}
      CORS_ORIGINS: ${CORS_ORIGINS:?CORS_ORIGINS is required (no wildcards in prod)}
      # Stability tuning (matches institutional display cadence)
      FLUSH_INTERVAL_MS: "2000"
      BATCH_SIZE: "20"
      MODEL_CHECKPOINT_PERIODIC_SEC: "300"
    depends_on:
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
    networks:
      - velure_internal
    volumes:
      - model_data:/app/data
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/health"]
      interval: 15s
      timeout: 5s
      retries: 4
      start_period: 60s
    deploy:
      resources:
        limits:
          memory: 4G
          cpus: "2.00"
        reservations:
          memory: 1G
          cpus: "0.50"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    logging: *default-logging

  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
    restart: always
    expose:
      - "3000"
    ports:
      # Same — TLS termination belongs in a reverse proxy.
      - "127.0.0.1:3000:3000"
    environment:
      # Public URLs — point to wherever the reverse proxy fronts the API
      NEXT_PUBLIC_WS_URL: ${PUBLIC_WS_URL:?PUBLIC_WS_URL is required (e.g. wss://velure.example.com/ws/dashboard)}
      NEXT_PUBLIC_API_URL: ${PUBLIC_API_URL:?PUBLIC_API_URL is required (e.g. https://velure.example.com)}
      HOSTNAME: "0.0.0.0"
      PORT: "3000"
    depends_on:
      backend:
        condition: service_healthy
    networks:
      - velure_internal
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:3000/"]
      interval: 20s
      timeout: 5s
      retries: 3
      start_period: 20s
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: "0.50"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /app/.next/cache
    logging: *default-logging

networks:
  velure_internal:
    driver: bridge
    # Set internal: true if you front-end this with a host-level reverse
    # proxy that doesn't run inside Docker. Leave commented if your proxy
    # joins this network.
    # internal: true

volumes:
  redis_data:
  postgres_data:
  model_data: