docker-compose.security.yml

version: '3.8'

# Security-hardened docker-compose configuration
# Compatible with read-only filesystems and heightened security measures

services:
  web:
    build: .
    ports:
      - "5000:5000"
    
    # Security hardening: run as non-root user
    user: "1000:1000"  # appuser:appgroup (created at build time)
    
    # Security hardening: read-only root filesystem
    read_only: true
    
    # Security hardening: limit capabilities
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE  # Allow binding to port 5000
    
    # Security hardening: no new privileges
    security_opt:
      - no-new-privileges:true
    
    # Security hardening: limit resources
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1.0'
        reservations:
          memory: 256M
          cpus: '0.5'
    
    # Writable temporary directories for read-only filesystem
    tmpfs:
      - /tmp:size=100M,mode=1777
      - /var/tmp:size=10M,mode=1777
      - /tmp/app-runtime:size=50M,uid=1000,gid=1000,mode=0755
    
    environment:
      - SECRET_KEY=${SECRET_KEY}
      - DATABASE_URL=${DATABASE_URL:-sqlite:///app/instance/subscriptions.db}
      - MAIL_SERVER=${MAIL_SERVER}
      - MAIL_PORT=${MAIL_PORT}
      - MAIL_USE_TLS=${MAIL_USE_TLS}
      - MAIL_USERNAME=${MAIL_USERNAME}
      - MAIL_PASSWORD=${MAIL_PASSWORD}
      - MAIL_FROM=${MAIL_FROM}
      - DAYS_BEFORE_EXPIRY=${DAYS_BEFORE_EXPIRY}
      # Timeout optimization settings
      - CURRENCY_REFRESH_MINUTES=${CURRENCY_REFRESH_MINUTES:-1440}
      - CURRENCY_PROVIDER_PRIORITY=${CURRENCY_PROVIDER_PRIORITY:-frankfurter,floatrates,erapi_open}
      - PERFORMANCE_LOGGING=${PERFORMANCE_LOGGING:-true}
    
    # Writable volumes (only what's necessary)
    volumes:
      - app_data:/app/instance:rw  # Application data (writable)
      - /etc/passwd:/etc/passwd:ro  # Optional: for user resolution
      - /etc/group:/etc/group:ro    # Optional: for group resolution
    
    healthcheck:
      test: ["CMD", "curl", "-f", "-s", "-o", "/dev/null", "http://localhost:5000/health"]
      interval: 5m
      timeout: 10s
      retries: 3
      start_period: 40s
    
    restart: unless-stopped
    
    # Security hardening: network isolation
    networks:
      - app_network
###Database options########
  # PostgreSQL with security hardening
  postgres:
    image: postgres:15-alpine
    user: "999:999"  # postgres user
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:size=100M,mode=1777
      - /var/run/postgresql:size=10M,uid=999,gid=999,mode=0755
    environment:
      - POSTGRES_DB=${POSTGRES_DB:-subscription_tracker}
      - POSTGRES_USER=${POSTGRES_USER:-subscription_tracker}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-subscription_tracker}
      - PGDATA=/var/lib/postgresql/data/pgdata
    volumes:
      - postgres_data:/var/lib/postgresql/data:rw
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-subscription_tracker} -d ${POSTGRES_DB:-subscription_tracker}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    profiles:
      - postgres
    restart: unless-stopped
    networks:
      - app_network

  # MariaDB with security hardening
  mariadb:
    image: mariadb:10.11
    user: "999:999"  # mysql user
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:size=100M,mode=1777
      - /var/run/mysqld:size=10M,uid=999,gid=999,mode=0755
    environment:
      - MYSQL_DATABASE=${MYSQL_DATABASE:-subscription_tracker}
      - MYSQL_USER=${MYSQL_USER:-subscription_tracker}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD:-subscription_tracker}
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD:-root_password}
    volumes:
      - mariadb_data:/var/lib/mysql:rw
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    profiles:
      - mariadb
    restart: unless-stopped
    networks:
      - app_network

# Isolated network for security
networks:
  app_network:
    driver: bridge
    internal: false  # Set to true for complete isolation

# Named volumes for persistent data
volumes:
  app_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${PWD}/data
  postgres_data:
    driver: local
  mariadb_data:

    driver: local