docker-compose.yml

version: "3.8"

services:
  # PostgreSQL Database
  postgres:
    image: postgres:15-alpine
    container_name: gasguard-postgres
    restart: unless-stopped
    security_opt:
      - "no-new-privileges:true"
    environment:
      POSTGRES_USER: ${DB_USER:-gasguard}
      POSTGRES_PASSWORD: ${DB_PASSWORD:-gasguard123}
      POSTGRES_DB: ${DB_NAME:-gasguard}
      POSTGRES_HOST_AUTH_METHOD: scram-sha-256
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./docker/postgres/init:/docker-entrypoint-initdb.d
    ports:
      - "5432:5432"
    networks:
      - gasguard-network
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${DB_USER:-gasguard}"]
      interval: 10s
      timeout: 5s
      retries: 5
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Redis for BullMQ
  redis:
    image: redis:7-alpine
    container_name: gasguard-redis
    restart: unless-stopped
    security_opt:
      - "no-new-privileges:true"
    command: redis-server --appendonly yes --requirepass ${REDIS_PASSWORD:-redis123}
    volumes:
      - redis-data:/data
    ports:
      - "6379:6379"
    networks:
      - gasguard-network
    healthcheck:
      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Backend API
  api:
    image: gasguard-api:stable
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    container_name: gasguard-api
    restart: unless-stopped
    security_opt:
      - "no-new-privileges:true"
    user: "10001:10001"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      NODE_ENV: ${NODE_ENV:-production}
      PORT: 3000
      DATABASE_URL: postgresql://${DB_USER:-gasguard}:${DB_PASSWORD:-gasguard123}@postgres:5432/${DB_NAME:-gasguard}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-redis123}
      RATE_LIMIT_TTL: ${RATE_LIMIT_TTL:-60}
      RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-10}
      API_VERSION: v1
      JWT_SECRET: ${JWT_SECRET:-your-secret-key-change-in-production}
    ports:
      - "3000:3000"
    networks:
      - gasguard-network
    volumes:
      - ./logs:/app/logs
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:3000/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Backend API - canary revision. Not started by `docker compose up`; only
  # brought up by scripts/canary-release.ts alongside nginx-canary. The
  # `api` service above is never rebuilt during a canary run, so it keeps
  # serving the last-promoted image while api-canary takes a weighted slice
  # of traffic. See docs/CANARY_RELEASES.md.
  api-canary:
    image: gasguard-api:canary
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    container_name: gasguard-api-canary
    restart: unless-stopped
    security_opt:
      - "no-new-privileges:true"
    user: "10001:10001"
    profiles: ["canary"]
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      NODE_ENV: ${NODE_ENV:-production}
      PORT: 3000
      DATABASE_URL: postgresql://${DB_USER:-gasguard}:${DB_PASSWORD:-gasguard123}@postgres:5432/${DB_NAME:-gasguard}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-redis123}
      RATE_LIMIT_TTL: ${RATE_LIMIT_TTL:-60}
      RATE_LIMIT_MAX: ${RATE_LIMIT_MAX:-10}
      API_VERSION: v1
      JWT_SECRET: ${JWT_SECRET:-your-secret-key-change-in-production}
    ports:
      - "${CANARY_API_PORT:-3001}:3000"
    networks:
      - gasguard-network
    volumes:
      - ./logs:/app/logs
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "--no-verbose",
          "--tries=1",
          "--spider",
          "http://localhost:3000/health",
        ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Weighted reverse proxy splitting traffic between api (stable) and
  # api-canary during a canary rollout. Only started for a canary run.
  nginx-canary:
    image: nginx:1.27-alpine
    container_name: gasguard-nginx-canary
    restart: unless-stopped
    security_opt:
      - "no-new-privileges:true"
    profiles: ["canary"]
    depends_on:
      - api
    environment:
      STABLE_WEIGHT: ${STABLE_WEIGHT:-95}
      CANARY_WEIGHT: ${CANARY_WEIGHT:-5}
    volumes:
      - ./docker/nginx/canary.conf.template:/etc/nginx/templates/default.conf.template:ro
    ports:
      - "${CANARY_PROXY_PORT:-8000}:80"
    networks:
      - gasguard-network
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Worker Service (BullMQ)
  worker:
    build:
      context: .
      dockerfile: apps/worker/Dockerfile
    container_name: gasguard-worker
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    environment:
      NODE_ENV: ${NODE_ENV:-production}
      DATABASE_URL: postgresql://${DB_USER:-gasguard}:${DB_PASSWORD:-gasguard123}@postgres:5432/${DB_NAME:-gasguard}
      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_PASSWORD: ${REDIS_PASSWORD:-redis123}
      WORKER_CONCURRENCY: ${WORKER_CONCURRENCY:-5}
    networks:
      - gasguard-network
    volumes:
      - ./logs:/app/logs
    deploy:
      replicas: ${WORKER_REPLICAS:-2}
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  # Dashboard (Optional)
  dashboard:
    build:
      context: .
      dockerfile: apps/dashboard/Dockerfile
    container_name: gasguard-dashboard
    restart: unless-stopped
    depends_on:
      - api
    environment:
      API_URL: http://api:3000
    ports:
      - "8080:80"
    networks:
      - gasguard-network
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

networks:
  gasguard-network:
    driver: bridge
    name: gasguard-network

volumes:
  postgres-data:
    name: gasguard-postgres-data
  redis-data:
    name: gasguard-redis-data