docker-compose.security.yml

# Security-hardened Docker Compose configuration for FlakeGuard
# Implements security best practices and defense-in-depth

version: '3.8'

# =============================================================================
# SERVICES
# =============================================================================
services:
  # API Server - Security Hardened
  api:
    build:
      context: ./apps/api
      dockerfile: Dockerfile.security
      args:
        - NODE_ENV=production
    image: flakeguard/api:security-latest
    container_name: flakeguard-api-secure
    restart: unless-stopped
    
    # Security configurations
    user: "1001:1001"  # Non-root user
    read_only: true     # Read-only root filesystem
    
    # Security options
    security_opt:
      - no-new-privileges:true
      - apparmor:docker-default
    
    # Drop all capabilities
    cap_drop:
      - ALL
    
    # Minimal capabilities if needed
    cap_add:
      - SETUID
      - SETGID
    
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
          pids: 100
        reservations:
          cpus: '0.5'
          memory: 512M
    
    # Temporary filesystems for writable directories
    tmpfs:
      - /tmp:noexec,nosuid,nodev,rw,size=100m
      - /var/tmp:noexec,nosuid,nodev,rw,size=50m
      - /var/log/flakeguard:noexec,nosuid,nodev,rw,size=100m
    
    # Environment variables
    environment:
      - NODE_ENV=production
      - PORT=3000
      - HOST=0.0.0.0
      - DATABASE_URL=postgresql://flakeguard:${POSTGRES_PASSWORD}@postgres:5432/flakeguard?sslmode=require
      - REDIS_URL=redis://redis:6379/0
      
      # Security configurations
      - ENABLE_CSRF_PROTECTION=true
      - ENABLE_AUDIT_LOGGING=true
      - WEBHOOK_SIGNATURE_REQUIRED=true
      - RATE_LIMIT_GLOBAL_MAX=1000
      - RATE_LIMIT_API_MAX=100
      - RATE_LIMIT_WEBHOOK_MAX=50
    
    # Secrets management
    secrets:
      - github_app_private_key
      - github_webhook_secret
      - jwt_secret
      - api_key
      - slack_signing_secret
      - slack_bot_token
    
    # Port mapping (only internal)
    expose:
      - "3000"
    
    # Network
    networks:
      - flakeguard-internal
    
    # Dependencies
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    
    # Health check
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/health', (res) => process.exit(res.statusCode === 200 ? 0 : 1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    
    # Logging
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
        labels: "service,security"

  # Worker Service - Security Hardened
  worker:
    build:
      context: ./apps/worker
      dockerfile: Dockerfile.security
    image: flakeguard/worker:security-latest
    container_name: flakeguard-worker-secure
    restart: unless-stopped
    
    # Security configurations
    user: "1001:1001"
    read_only: true
    
    security_opt:
      - no-new-privileges:true
      - apparmor:docker-default
    
    cap_drop:
      - ALL
    
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '1.5'
          memory: 768M
          pids: 50
        reservations:
          cpus: '0.25'
          memory: 256M
    
    tmpfs:
      - /tmp:noexec,nosuid,nodev,rw,size=50m
      - /var/tmp:noexec,nosuid,nodev,rw,size=25m
    
    environment:
      - NODE_ENV=production
      - DATABASE_URL=postgresql://flakeguard:${POSTGRES_PASSWORD}@postgres:5432/flakeguard?sslmode=require
      - REDIS_URL=redis://redis:6379/0
    
    secrets:
      - github_app_private_key
      - jwt_secret
    
    networks:
      - flakeguard-internal
    
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    
    healthcheck:
      test: ["CMD", "node", "-e", "console.log('Worker health check')"]
      interval: 60s
      timeout: 10s
      retries: 2
      start_period: 30s

  # PostgreSQL - Security Hardened
  postgres:
    image: postgres:16-alpine
    container_name: flakeguard-postgres-secure
    restart: unless-stopped
    
    # Security configurations
    user: "999:999"  # postgres user
    read_only: false  # Database needs write access
    
    security_opt:
      - no-new-privileges:true
      - apparmor:docker-default
    
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - DAC_OVERRIDE
    
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
          pids: 100
        reservations:
          cpus: '0.25'
          memory: 256M
    
    # Environment
    environment:
      - POSTGRES_DB=flakeguard
      - POSTGRES_USER=flakeguard
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_INITDB_ARGS=--auth-host=scram-sha-256 --auth-local=scram-sha-256
    
    # Data persistence
    volumes:
      - postgres_data:/var/lib/postgresql/data:rw,Z
      - ./postgresql.conf:/etc/postgresql/postgresql.conf:ro,Z
    
    # Command with security settings
    command: [
      "postgres",
      "-c", "config_file=/etc/postgresql/postgresql.conf",
      "-c", "ssl=on",
      "-c", "ssl_cert_file=/var/lib/postgresql/server.crt",
      "-c", "ssl_key_file=/var/lib/postgresql/server.key",
      "-c", "log_statement=ddl",
      "-c", "log_min_duration_statement=1000"
    ]
    
    expose:
      - "5432"
    
    networks:
      - flakeguard-internal
    
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U flakeguard -d flakeguard"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

  # Redis - Security Hardened
  redis:
    image: redis:7-alpine
    container_name: flakeguard-redis-secure
    restart: unless-stopped
    
    # Security configurations
    user: "999:999"  # redis user
    read_only: true
    
    security_opt:
      - no-new-privileges:true
      - apparmor:docker-default
    
    cap_drop:
      - ALL
    
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 256M
          pids: 50
        reservations:
          cpus: '0.1'
          memory: 64M
    
    # Temporary filesystems
    tmpfs:
      - /tmp:noexec,nosuid,nodev,rw,size=50m
      - /var/run/redis:noexec,nosuid,nodev,rw,size=10m
    
    # Command with security settings
    command: [
      "redis-server",
      "--requirepass", "${REDIS_PASSWORD}",
      "--appendonly", "yes",
      "--maxmemory", "200mb",
      "--maxmemory-policy", "allkeys-lru",
      "--tcp-keepalive", "60",
      "--timeout", "300",
      "--bind", "0.0.0.0",
      "--protected-mode", "yes"
    ]
    
    # Data persistence
    volumes:
      - redis_data:/data:rw,Z
    
    expose:
      - "6379"
    
    networks:
      - flakeguard-internal
    
    healthcheck:
      test: ["CMD", "redis-cli", "--no-auth-warning", "-a", "${REDIS_PASSWORD}", "ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

  # Reverse Proxy (NGINX) - Security Hardened
  nginx:
    image: nginx:1.25-alpine
    container_name: flakeguard-nginx-secure
    restart: unless-stopped
    
    # Security configurations
    user: "101:101"  # nginx user
    read_only: true
    
    security_opt:
      - no-new-privileges:true
      - apparmor:docker-default
    
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - NET_BIND_SERVICE
    
    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 128M
          pids: 10
        reservations:
          cpus: '0.1'
          memory: 32M
    
    # Temporary filesystems
    tmpfs:
      - /var/run:noexec,nosuid,nodev,rw,size=10m
      - /var/cache/nginx:noexec,nosuid,nodev,rw,size=50m
      - /var/log/nginx:noexec,nosuid,nodev,rw,size=10m
    
    # Configuration
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro,Z
      - ./nginx/security.conf:/etc/nginx/conf.d/security.conf:ro,Z
      - ./certs:/etc/nginx/certs:ro,Z
    
    ports:
      - "443:443"
      - "80:80"
    
    networks:
      - flakeguard-internal
      - flakeguard-external
    
    depends_on:
      - api
    
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

# =============================================================================
# NETWORKS
# =============================================================================
networks:
  # Internal network for service communication
  flakeguard-internal:
    driver: bridge
    internal: true
    driver_opts:
      com.docker.network.bridge.enable_icc: "true"
      com.docker.network.bridge.enable_ip_masquerade: "false"
    ipam:
      driver: default
      config:
        - subnet: 172.20.0.0/16
  
  # External network for public access
  flakeguard-external:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.enable_icc: "false"
      com.docker.network.bridge.enable_ip_masquerade: "true"
    ipam:
      driver: default
      config:
        - subnet: 172.21.0.0/16

# =============================================================================
# VOLUMES
# =============================================================================
volumes:
  postgres_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ./data/postgres
  
  redis_data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ./data/redis

# =============================================================================
# SECRETS
# =============================================================================
secrets:
  github_app_private_key:
    file: ./secrets/github-app-private-key.pem
  
  github_webhook_secret:
    file: ./secrets/github-webhook-secret.txt
  
  jwt_secret:
    file: ./secrets/jwt-secret.txt
  
  api_key:
    file: ./secrets/api-key.txt
  
  slack_signing_secret:
    file: ./secrets/slack-signing-secret.txt
  
  slack_bot_token:
    file: ./secrets/slack-bot-token.txt

# =============================================================================
# CONFIGURATION NOTES
# =============================================================================
# 
# To use this security-hardened configuration:
# 
# 1. Create secrets directory and files:
#    mkdir -p secrets
#    echo "your-jwt-secret" > secrets/jwt-secret.txt
#    echo "EXAMPLE-API-KEY" > secrets/api-key.txt
#    # ... add other secrets
# 
# 2. Set environment variables:
#    export POSTGRES_PASSWORD=$(openssl rand -base64 32)
#    export REDIS_PASSWORD=$(openssl rand -base64 32)
# 
# 3. Create data directories:
#    mkdir -p data/{postgres,redis}
#    chmod 700 data/{postgres,redis}
# 
# 4. Generate TLS certificates:
#    mkdir -p certs
#    # Add your SSL certificates
# 
# 5. Start services:
#    docker-compose -f docker-compose.security.yml up -d
# 
# Security Features Implemented:
# - Non-root users in all containers
# - Read-only root filesystems where possible
# - Dropped capabilities (principle of least privilege)
# - Resource limits to prevent DoS
# - Network segmentation
# - Secrets management
# - Security options (AppArmor, no-new-privileges)
# - Health checks for all services
# - Logging configuration
# - TLS encryption between services