docker-compose.prod.yml

# CloudGraph Production Docker Compose
# Usage: docker compose -f docker-compose.prod.yml up -d
#
# REQUIRED: Create a .env file with at minimum:
#   NEO4J_PASSWORD=your_secure_password
#   JWT_SECRET=your_32_char_minimum_secret
#
# Production features:
# - Non-root user execution
# - Resource limits
# - Read-only filesystems where possible
# - Internal network isolation
# - Comprehensive health checks
# - Log rotation
# - Security options enabled

services:
  # ============================================================================
  # Neo4j Graph Database
  # ============================================================================
  neo4j:
    image: neo4j:5
    container_name: cloudgraph-neo4j
    restart: unless-stopped
    ports:
      - "7687:7687"   # Bolt protocol only (no HTTP browser in prod)
      # Uncomment below for Neo4j browser access (not recommended in production)
      # - "7474:7474"
    environment:
      NEO4J_AUTH: ${NEO4J_USER:-neo4j}/${NEO4J_PASSWORD:?NEO4J_PASSWORD is required}
      NEO4J_PLUGINS: '["apoc"]'
      # Memory configuration (adjust based on available resources)
      NEO4J_dbms_memory_heap_initial__size: 512m
      NEO4J_dbms_memory_heap_max__size: 1G
      NEO4J_dbms_memory_pagecache_size: 512m
      # Security settings
      NEO4J_dbms_security_procedures_unrestricted: apoc.*
      NEO4J_dbms_security_procedures_allowlist: apoc.*
      # Disable remote shell
      NEO4J_dbms_shell_enabled: "false"
    volumes:
      - neo4j_data:/data
      - neo4j_logs:/logs
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:7474"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 1G
    networks:
      - cloudgraph-internal
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"

  # ============================================================================
  # CloudGraph API Server
  # ============================================================================
  api:
    image: cloudgraph-api:${CLOUDGRAPH_VERSION:-latest}
    build:
      context: .
      dockerfile: Dockerfile
    container_name: cloudgraph-api
    restart: unless-stopped
    ports:
      - "9847:9847"
    environment:
      # Neo4j connection
      CLOUDGRAPH_NEO4J_URI: bolt://neo4j:7687
      CLOUDGRAPH_NEO4J_USER: ${NEO4J_USER:-neo4j}
      CLOUDGRAPH_NEO4J_PASSWORD: ${NEO4J_PASSWORD:?NEO4J_PASSWORD is required}
      # Authentication (REQUIRED in production)
      CLOUDGRAPH_AUTH_ENABLED: "true"
      CLOUDGRAPH_JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required (min 32 chars)}
      CLOUDGRAPH_JWT_EXPIRY: ${JWT_EXPIRY:-3600}
      # CORS - set to your actual UI domain
      CLOUDGRAPH_CORS_ORIGINS: ${CORS_ORIGINS:-http://localhost:8080}
      # Logging
      CLOUDGRAPH_LOG_LEVEL: ${LOG_LEVEL:-INFO}
      # Query limits
      CLOUDGRAPH_MAX_QUERY_LIMIT: ${MAX_QUERY_LIMIT:-10000}
    volumes:
      - api_data:/app/data
    depends_on:
      neo4j:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9847/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M
    # Security settings
    read_only: true
    tmpfs:
      - /tmp:size=100M,mode=1777
    security_opt:
      - no-new-privileges:true
    networks:
      - cloudgraph-internal
      - cloudgraph-external
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # ============================================================================
  # CloudGraph UI (Static Web Interface)
  # ============================================================================
  ui:
    image: cloudgraph-ui:${CLOUDGRAPH_VERSION:-latest}
    build:
      context: ./ui
      dockerfile: Dockerfile
    container_name: cloudgraph-ui
    restart: unless-stopped
    ports:
      - "8080:80"
    depends_on:
      api:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:80/"]
      interval: 30s
      timeout: 10s
      retries: 3
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 128M
        reservations:
          cpus: '0.1'
          memory: 64M
    # Security settings
    read_only: true
    tmpfs:
      - /var/cache/nginx:size=50M
      - /var/run:size=10M
      - /var/log/nginx:size=20M
    security_opt:
      - no-new-privileges:true
    networks:
      - cloudgraph-external
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "3"

# ==============================================================================
# Volumes - Persistent data storage
# ==============================================================================
volumes:
  neo4j_data:
    driver: local
  neo4j_logs:
    driver: local
  api_data:
    driver: local

# ==============================================================================
# Networks - Isolated network segments
# ==============================================================================
networks:
  # Internal network - API to Neo4j communication only
  cloudgraph-internal:
    driver: bridge
    internal: true
  # External network - UI and API exposed to users
  cloudgraph-external:
    driver: bridge