docker-compose.yaml

services:
  # PostgreSQL Database
  postgres:
    image: postgres:15.10-alpine
    container_name: worklenz-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${DB_NAME:-worklenz_db}
      POSTGRES_USER: ${DB_USER:-postgres}
      POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD is required}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --lc-collate=en_US.UTF-8 --lc-ctype=en_US.UTF-8"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./scripts/db-init-wrapper.sh:/docker-entrypoint-initdb.d/00-init-wrapper.sh:ro
      - ./worklenz-backend/database:/database:ro
      - ./backups:/pg_backups
    networks:
      - worklenz-backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-postgres} -d ${DB_NAME:-worklenz_db}"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    security_opt:
      - no-new-privileges:true

  # Database Backup Service
  db-backup:
    image: postgres:15.10-alpine
    container_name: worklenz-db-backup
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PGHOST: postgres
      PGPORT: 5432
      PGDATABASE: ${DB_NAME:-worklenz_db}
      PGUSER: ${DB_USER:-postgres}
      PGPASSWORD: ${DB_PASSWORD}
      BACKUP_RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-30}
    volumes:
      - ./backups:/backups
    networks:
      - worklenz-backend
    entrypoint: /bin/sh
    command: >
      -c "
      while true; do
        echo 'Running database backup...'
        BACKUP_FILE=\"/backups/worklenz_backup_$$(date +%Y%m%d_%H%M%S).sql\"
        pg_dump > \"$$BACKUP_FILE\" 2>&1
        if [ $$? -eq 0 ]; then
          echo \"Database dump completed: $$BACKUP_FILE\"
          gzip \"$$BACKUP_FILE\"
          if [ $$? -eq 0 ]; then
            echo \"Backup compression completed: $$BACKUP_FILE.gz\"
            echo \"Cleaning up backups older than $$BACKUP_RETENTION_DAYS days...\"
            find /backups -name 'worklenz_backup_*.sql.gz' -mtime +$$BACKUP_RETENTION_DAYS -delete
            echo \"Cleanup completed successfully\"
          else
            echo \"ERROR: Backup compression failed for $$BACKUP_FILE\"
            echo \"Removing incomplete uncompressed backup file...\"
            rm -f \"$$BACKUP_FILE\"
            echo \"Skipping cleanup due to backup failure\"
          fi
        else
          echo 'ERROR: Database backup failed'
          echo \"Removing failed backup file: $$BACKUP_FILE\"
          rm -f \"$$BACKUP_FILE\"
          echo \"Skipping cleanup due to backup failure\"
        fi
        echo 'Next backup in 24 hours...'
        sleep 86400
      done
      "
    profiles:
      - backup

  # Redis Cache (Express mode - default)
  redis:
    image: redis:7.4-alpine
    container_name: worklenz-redis
    restart: unless-stopped
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-worklenz_redis_pass}
    volumes:
      - redis_data:/data
    networks:
      - worklenz-backend
    healthcheck:
      test: ["CMD", "sh", "-c", "redis-cli -a ${REDIS_PASSWORD:-worklenz_redis_pass} ping"]
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 10s
    security_opt:
      - no-new-privileges:true
    profiles:
      - express

  # MinIO Object Storage (Express mode - default)
  minio:
    image: minio/minio:latest
    container_name: worklenz-minio
    restart: unless-stopped
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${AWS_ACCESS_KEY_ID:-minioadmin}
      MINIO_ROOT_PASSWORD: ${AWS_SECRET_ACCESS_KEY:-minioadmin}
      MINIO_BROWSER: ${MINIO_BROWSER:-on}
    volumes:
      - minio_data:/data
    networks:
      - worklenz-backend
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 20s
      retries: 3
      start_period: 10s
    security_opt:
      - no-new-privileges:true
    profiles:
      - express

  # MinIO Client - Create initial bucket (Express mode)
  minio-init:
    image: minio/mc:latest
    container_name: worklenz-minio-init
    depends_on:
      minio:
        condition: service_healthy
    environment:
      MINIO_ROOT_USER: ${AWS_ACCESS_KEY_ID:-minioadmin}
      MINIO_ROOT_PASSWORD: ${AWS_SECRET_ACCESS_KEY:-minioadmin}
      MINIO_BUCKET: ${AWS_BUCKET:-worklenz-bucket}
    networks:
      - worklenz-backend
    entrypoint: >
      /bin/sh -c "
      echo 'Waiting for MinIO to be ready...';
      sleep 5;
      /usr/bin/mc alias set worklenz http://minio:9000 $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD};
      /usr/bin/mc mb worklenz/$${MINIO_BUCKET} --ignore-existing;
      /usr/bin/mc anonymous set download worklenz/$${MINIO_BUCKET};
      echo 'MinIO bucket created and configured successfully';
      exit 0;
      "
    profiles:
      - express

  # Backend API
  backend:
    image: chamikajaycey/worklenz-backend:${BACKEND_VERSION:-2.1.6}
    build:
      context: ./worklenz-backend
      dockerfile: Dockerfile
    container_name: worklenz-backend
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      # Server Configuration
      NODE_ENV: production
      PORT: 3000
      SESSION_SECRET: ${SESSION_SECRET:?SESSION_SECRET is required}
      COOKIE_SECRET: ${COOKIE_SECRET:?COOKIE_SECRET is required}
      SESSION_NAME: ${SESSION_NAME:-worklenz.sid}

      # Database Configuration
      DB_HOST: postgres
      DB_PORT: 5432
      DB_NAME: ${DB_NAME:-worklenz_db}
      DB_USER: ${DB_USER:-postgres}
      DB_PASSWORD: ${DB_PASSWORD}
      DB_MAX_CLIENTS: ${DB_MAX_CLIENTS:-50}
      USE_PG_NATIVE: ${USE_PG_NATIVE:-false}

      # CORS Configuration
      SERVER_CORS: ${SERVER_CORS:-*}
      SOCKET_IO_CORS: ${SOCKET_IO_CORS}
      FRONTEND_URL: ${FRONTEND_URL}

      # Storage Configuration
      STORAGE_PROVIDER: ${STORAGE_PROVIDER:-s3}

      # Redis Configuration
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-worklenz_redis_pass}
      REDIS_DB: ${REDIS_DB:-0}

      # S3/MinIO Configuration (Express mode default)
      AWS_REGION: ${AWS_REGION:-us-east-1}
      AWS_BUCKET: ${AWS_BUCKET:-worklenz-bucket}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-minioadmin}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-minioadmin}
      S3_URL: ${S3_URL:-http://minio:9000}

      # Azure Blob Storage Configuration (Advanced mode)
      AZURE_STORAGE_ACCOUNT_NAME: ${AZURE_STORAGE_ACCOUNT_NAME:-}
      AZURE_STORAGE_CONTAINER: ${AZURE_STORAGE_CONTAINER:-}
      AZURE_STORAGE_ACCOUNT_KEY: ${AZURE_STORAGE_ACCOUNT_KEY:-}
      AZURE_STORAGE_URL: ${AZURE_STORAGE_URL:-}

      # Google OAuth (Optional)
      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
      GOOGLE_CALLBACK_URL: ${GOOGLE_CALLBACK_URL:-}

      # Email Configuration (Optional)
      ENABLE_EMAIL_CRONJOBS: ${ENABLE_EMAIL_CRONJOBS:-false}
      CONTACT_US_EMAIL: ${CONTACT_US_EMAIL:-}

      # JWT Configuration
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}

      # Google Recaptcha (Optional)
      GOOGLE_CAPTCHA_SECRET_KEY: ${GOOGLE_CAPTCHA_SECRET_KEY:-}
      GOOGLE_CAPTCHA_PASS_SCORE: ${GOOGLE_CAPTCHA_PASS_SCORE:-0.8}

      # Timezone
      TZ: ${TZ:-UTC}

    volumes:
      - backend_logs:/app/logs
    networks:
      - worklenz-backend
      - worklenz-frontend
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/public/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    security_opt:
      - no-new-privileges:true

  # Frontend Application
  frontend:
    image: chamikajaycey/worklenz-frontend:${FRONTEND_VERSION:-2.1.6}
    build:
      context: ./worklenz-frontend
      dockerfile: Dockerfile
    container_name: worklenz-frontend
    restart: unless-stopped
    depends_on:
      backend:
        condition: service_healthy
    environment:
      # Runtime environment variables (injected at startup)
      VITE_API_URL: ${VITE_API_URL}
      VITE_SOCKET_URL: ${VITE_SOCKET_URL}
      VITE_APP_TITLE: ${VITE_APP_TITLE:-Worklenz}
      VITE_APP_ENV: production
      VITE_ENABLE_RECAPTCHA: ${VITE_ENABLE_RECAPTCHA:-false}
      VITE_RECAPTCHA_SITE_KEY: ${VITE_RECAPTCHA_SITE_KEY:-}
      VITE_ENABLE_GOOGLE_LOGIN: ${VITE_ENABLE_GOOGLE_LOGIN:-false}
      VITE_ENABLE_SURVEY_MODAL: ${VITE_ENABLE_SURVEY_MODAL:-false}
    networks:
      - worklenz-frontend
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    security_opt:
      - no-new-privileges:true

  # Nginx Reverse Proxy
  nginx:
    image: nginx:1.27-alpine
    container_name: worklenz-nginx
    restart: unless-stopped
    depends_on:
      frontend:
        condition: service_healthy
      backend:
        condition: service_healthy
    ports:
      - "${HTTP_PORT:-80}:80"
      - "${HTTPS_PORT:-443}:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
      - certbot_certs:/etc/letsencrypt:ro
      - certbot_www:/var/www/certbot:ro
      - nginx_logs:/var/log/nginx
    networks:
      - worklenz-frontend
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:80/health"]
      interval: 30s
      timeout: 10s
      retries: 3
    security_opt:
      - no-new-privileges:true
    command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"

  # Certbot for Let's Encrypt SSL
  certbot:
    image: certbot/certbot:v3.1.0
    container_name: worklenz-certbot
    restart: unless-stopped
    volumes:
      - certbot_certs:/etc/letsencrypt
      - certbot_www:/var/www/certbot
    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
    profiles:
      - ssl

networks:
  worklenz-backend:
    driver: bridge
    internal: true
  worklenz-frontend:
    driver: bridge

volumes:
  postgres_data:
    driver: local
  redis_data:
    driver: local
  minio_data:
    driver: local
  backend_logs:
    driver: local
  nginx_logs:
    driver: local
  certbot_certs:
    driver: local
  certbot_www:
    driver: local