docker-compose.prod.yml

# ============================================
# DeeperSensor API - Production Compose
# ============================================
# Optimized for production deployment with:
# - Resource limits
# - Health checks
# - Security hardening
# - Proper restart policies
# - Network isolation

version: "3.9"

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge
    internal: true

volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local
  ollama_models:
    driver: local

services:
  # ===========================================
  # API Service
  # ===========================================
  api:
    build:
      context: .
      dockerfile: crates/api/Dockerfile
      args:
        RUST_VERSION: "1.82"
    image: deepersensor/api:${IMAGE_TAG:-latest}
    container_name: deepersensor-api
    
    env_file:
      - .env
    
    environment:
      - APP_ENV=production
      - DATABASE_URL=postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-deepersensor}
      - REDIS_URL=redis://:${REDIS_PASSWORD:-changeme}@redis:6379/0
      - OLLAMA_BASE_URL=http://ollama:11434
    
    expose:
      - "8080"
    
    networks:
      - frontend
      - backend
    
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      ollama:
        condition: service_started
    
    healthcheck:
      test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/health || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 40s
    
    restart: unless-stopped
    
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    
    security_opt:
      - no-new-privileges:true
    
    cap_drop:
      - ALL
    
    read_only: true
    
    tmpfs:
      - /tmp:size=100M,mode=1777
    
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service=api"

  # ===========================================
  # PostgreSQL Database
  # ===========================================
  postgres:
    image: postgres:16-alpine
    container_name: deepersensor-postgres
    
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-postgres}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-postgres}
      - POSTGRES_DB=${POSTGRES_DB:-deepersensor}
      - PGDATA=/var/lib/postgresql/data/pgdata
    
    expose:
      - "5432"
    
    networks:
      - backend
    
    volumes:
      - postgres_data:/var/lib/postgresql/data
    
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    
    restart: unless-stopped
    
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
        reservations:
          cpus: '0.25'
          memory: 256M
    
    security_opt:
      - no-new-privileges:true
    
    command:
      - "postgres"
      - "-c"
      - "max_connections=100"
      - "-c"
      - "shared_buffers=256MB"
      - "-c"
      - "effective_cache_size=1GB"
      - "-c"
      - "maintenance_work_mem=64MB"
      - "-c"
      - "checkpoint_completion_target=0.9"
      - "-c"
      - "wal_buffers=16MB"
      - "-c"
      - "default_statistics_target=100"
      - "-c"
      - "random_page_cost=1.1"
      - "-c"
      - "effective_io_concurrency=200"
      - "-c"
      - "work_mem=2621kB"
      - "-c"
      - "min_wal_size=1GB"
      - "-c"
      - "max_wal_size=4GB"
    
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service=postgres"

  # ===========================================
  # Redis Cache
  # ===========================================
  redis:
    image: redis:7-alpine
    container_name: deepersensor-redis
    
    command:
      - "redis-server"
      - "--requirepass"
      - "${REDIS_PASSWORD:-changeme}"
      - "--maxmemory"
      - "256mb"
      - "--maxmemory-policy"
      - "allkeys-lru"
      - "--save"
      - ""
      - "--appendonly"
      - "no"
    
    expose:
      - "6379"
    
    networks:
      - backend
    
    volumes:
      - redis_data:/data
    
    healthcheck:
      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 5s
    
    restart: unless-stopped
    
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.1'
          memory: 128M
    
    security_opt:
      - no-new-privileges:true
    
    logging:
      driver: "json-file"
      options:
        max-size: "5m"
        max-file: "2"
        labels: "service=redis"

  # ===========================================
  # Ollama Model Server
  # ===========================================
  ollama:
    image: ollama/ollama:latest
    container_name: deepersensor-ollama
    
    expose:
      - "11434"
    
    networks:
      - backend
    
    volumes:
      - ollama_models:/root/.ollama
    
    restart: unless-stopped
    
    deploy:
      resources:
        limits:
          cpus: '4.0'
          memory: 8G
        reservations:
          cpus: '1.0'
          memory: 2G
    
    security_opt:
      - no-new-privileges:true
    
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "2"
        labels: "service=ollama"

  # ===========================================
  # Nginx Reverse Proxy
  # ===========================================
  nginx:
    build:
      context: .
      dockerfile: nginx/Dockerfile
    image: deepersensor/nginx:${IMAGE_TAG:-latest}
    container_name: deepersensor-nginx
    
    depends_on:
      api:
        condition: service_healthy
    
    ports:
      - "${NGINX_HTTP_PORT:-80}:80"
      # Uncomment for TLS
      # - "${NGINX_HTTPS_PORT:-443}:443"
    
    networks:
      - frontend
    
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s
    
    restart: unless-stopped
    
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
        reservations:
          cpus: '0.1'
          memory: 64M
    
    security_opt:
      - no-new-privileges:true
    
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - CHOWN
      - SETUID
      - SETGID
    
    read_only: true
    
    tmpfs:
      - /var/cache/nginx:size=50M,mode=0755
      - /var/run:size=10M,mode=0755
      - /tmp:size=10M,mode=1777
    
    # For TLS certificates
    # volumes:
    #   - ./certs:/etc/nginx/certs:ro
    
    logging:
      driver: "json-file"
      options:
        max-size: "20m"
        max-file: "5"
        labels: "service=nginx"